Kasey Cross Security Evangelist A10 Networks

This set of Top 5 security predictions also offers recommendations on how to protect your organizations’ network throughout the year.  With so many breaches and exploits it was difficult to narrow the list to a Top 5, but we believe these will be the most significate threats in 2015.

1.    The Internet of Things (IoT) will expose new security risks
Even though IoT is still in its early stages, the number of devices connected to the Internet is growing, thereby increasing the potential for attacks at any time.  The Internet of Things promises to make our lives easier, but without proper safeguards, it also opens us up to an array of new security threats.  Potential IoT risks include:

• Malware infecting PCs and tablets that manage IoT devices, such as home security systems or cameras.
• Attackers using brute force or knowledge of default credentials to gain access to IoT devices or to the cloud infrastructure that stores IoT data.
• Malware infiltrating high-end IoT devices, such as SmartTVs, that have full Android operating systems and access to app stores.

To reduce these risks, consumers and businesses alike should avoid installing unknown software and, whenever possible, configure strong passwords on devices.  A recent hack of more than 73,000 webcams underscores the importance of using strong passwords on IoT devices.  In addition IT should investigate how the device is accessed and whether it stores sensitive data.

2.    A new distributed denial of service (DDoS) amplification attack will emerge
Over the past two years, cybercriminals and other mischief-makers have exploited DNS and NTP servers to amplify the size of their DDoS attacks.  With DNS and NTP amplification attacks, an attacker spoofs, or impersonates, the attack target and sends a small request to a reflector, which is a server that replies with a much larger response to the victim, flooding the victim’s network.

According to the United States Computer Emergency Readiness Team, DNS amplification attacks can increase the size of DDoS attacks by up to 54 times, while NTP amplification attacks can magnify DDoS onslaughts by a factor of 556 times.  But DNS and NTP are not the only culprits of amplification attacks.  Attackers can also leverage SNMP, NetBIOS, and other protocols to launch amplification attacks.  Attackers have even exploited WordPress applications to carry out large-scale DDoS assaults.

Attackers continually investigate new attack vectors, as witnessed by the recent discovery of DVMRP-based reflection attacks.  We believe that in 2015 a new type of DDoS amplification attack will make headlines.  While DNS and NTP amplification took the security world by storm in 2013 and 2014, attackers will uncover and exploit a yet unknown attack next year.  To protect against amplification attacks in 2015, organizations should deploy security equipment that can mitigate large-scale DDoS attacks.

3.    Traditionally secure infrastructure will be compromised
We predict that in 2015 attackers will execute more brute force attacks and conduct new and creative attacks on virtual desktops.  Virtual Desktop Infrastructure (VDI) allows organizations to host desktop environments on servers and enables users to access these desktops from any location.  Compared to traditional desktop infrastructures, VDI provides a host of advantages; organizations can lower hardware and operating costs, support Bring Your Own Device (BYOD) initiatives, and bolster security.  Since all data is stored in a central location—rather than on endpoint devices—VDI reduces physical data theft risks.

However, desktop virtualization also exposes new security challenges.  Organizations often host multiple desktops with the same operating systems and the same set of applications on a single physical server.  Without proper isolation, an attacker can install a rootkit and compromise multiple desktops.  With limited system diversity, attackers might uncover a vulnerability, allowing them to quickly exploit thousands of desktops in one fell swoop.

To protect VDI environments, organizations should implement operating system or application isolation—especially if virtual desktops are hosted in the cloud.  Organizations should also control how data can be transferred to and from VDI environments, install anti-malware software, and monitor for intrusions.

4.    POS systems will still be at risk, but smart cards will reduce breach costs
Retail breaches overshadowed virtually every other attack vector in late 2013 and 2014.  A continuous parade of breach disclosures hit headlines and affected many of the world’s most well-known retail brands.  The culprit behind these breaches: malware infections on point-of-sale (POS) devices.  Using a variety of techniques, including brute force and compromising management or software update tools, hackers are able to install malware on POS systems.  The malware scrapes credit card numbers and CVVs from system memory.  The most advanced malware strains can actually capture data from inter-process communications, quickly zeroing in on payment card data.

While we predict that these attacks will continue, the migration to chip-and-pin smartcards toward the end of 2015 will make it harder for hackers to monetize the data stolen from POS systems.  They won’t be able to use fake magnetic cards and will primarily be relegated to online payment fraud.

What should organizations do to prevent POS-based breaches?  They can protect POS systems from malware using white-listing, code-signing and behavioral techniques, harden systems against compromise by controlling who and what can access POS terminals, and monitor for infiltrations with advanced threat prevention platforms.  And since malware can communicate to command and control servers over SSL and over normally harmless protocols such as DNS, organizations should inspect all traffic, including encrypted traffic.

5.    Malvertisers will continue to infiltrate ad networks
Malware-laden ads often silently infect machines without users’ knowledge.  Traditional security tools that “black list” malicious sites cannot easily block malvertisers’ ads because the malware-laden advertisements are hosted by legitimate websites and the ads constantly change.  Malware distributors have zeroed in on a fast and effective way to infect millions of users by malvertising.  With malvertising, cybercriminals distribute malicious code through online advertising networks.

We predict that malvertisers will take advantage of new exploits, known exploits such as Dynamic DNS, and signature and sandbox evasion techniques, to further propagate their malware across advertising networks.  To prevent these attacks, organizations should install anti-malware software on client machines and enforce security controls on clients’ browsers, as well as decrypt and inspect encrypted traffic.  Advanced threat protection platforms can also help detect malware in web traffic.