Security troubles in e commerce website

The document discusses third party cyber risk. It begins by describing how a CISO discovered that a data breach originated from a third party data management company, not from within their own systems. It then discusses how third parties like vendors, suppliers, and external software pose cyber risks. The document provides an overview of assessing third party risk, recent breaches caused by third parties, and how NormShield's cyber risk scorecard can help companies evaluate third party cyber risk.

In 2013, targeted attacks increased, with spear-phishing attacks rising 91% over 2012. Watering hole attacks utilizing unpatched website vulnerabilities and zero-day exploits also grew. Eight data breaches exposed over 10 million identities each, termed "mega breaches". A total of 552 million identities were breached in 2013, over 5 times more than the 93 million in 2012. Web attacks blocked per day rose 23% from 2012. 78% of websites had vulnerabilities, and 16% had critical vulnerabilities that could be easily exploited by attackers.

As reported in the ISTR Volume 19, 2013 saw a 500 percent increase in ransomware in the latter part of the year. Overall ransomware levels remained high through March 2014, and then slowly started to decline, in part due to the disruption of the GameOver Zeus botnet back in late May. In contrast, crypto-style ransomware has seen a 700 percent-plus increase. These file-encrypting versions of ransomware began the year comprising 1.2 percent of all ransomware detec¬tions, but now make up 31 percent at the end of August. One variant known as Trojan.Cryptodefense began to appear in large numbers in early June. By the end of July, it made up 77 percent of all crypto-style ransomware for the year to date. This follows predictions in the ISTR saying this type of malware would become more common in 2014. Over 31.5 million identities were reported exposed in August, from 12 incidents. The jump in exposed identities is due to a large breach in South Korea, comprising 27 million identities. In the last 12 months 53 percent of data breaches were caused by hacking and 21 percent were accidentally made public. The average number of spear-phishing emails blocked each day for August was 20, compared with 54 in July and 88 in June. This is below the year-to-date average of 86, which is slightly higher than the daily average of 84 for all if 2013. The most frequently used malicious file types in these email-based targeted attacks were .exe and .doc file types, with .exe attachments coming out on top this month at 31.8 percent. 29 percent of spear phishing emails were sent to Manufacturing, returning it to the top of the industries targeted. One in 1,587 emails was identified as a phishing attempt, compared with one in 1,298 for July and one in 496 in June. While at first glance this looks like a big drop, it is not indica¬tive of a wider trend just yet, resulting in only a 0.01 percentage point decrease in the overall phishing rate. We hope that you enjoy this month’s report and feel free to contact us with any comments or feedback.

This document discusses cyber security trends based on data collected by IBM from monitoring over 3,700 clients in 130+ countries. Some key points: - On average, organizations experience 73,400 attacks, 90 security incidents, and 81.9 million security events annually. - Manufacturing and finance face the most incidents, accounting for nearly 50% of incidents. - Malicious code and sustained probes/scans make up over 60% of incident categories. Most incidents are attributed to end-user error and misconfigured systems. - Opportunistic attacks motivated by opportunity account for nearly 50% of attackers. Outsiders instigate around half of all attacks.

- In 2017, financial phishing attacks increased, accounting for over half of all phishing detections according to Kaspersky Lab. Attacks targeted major banks, payment systems, and online shops. - Banking malware attacks decreased in 2017 but still posed a threat, with the Zbot and Gozi families being the most widespread. Android banking malware also decreased slightly. - Emerging threats in 2017 included the Silence hacking group that targeted 10 financial organizations, stealing millions, and new malware like Cutlet Maker designed to target ATMs.

This document summarizes key trends from the Symantec Internet Security Threat Report for 2013. It finds that 2013 saw a dramatic rise in large data breaches exposing over 10 million identities each. Targeted attacks increased and evolved to use more "low and slow" spear phishing campaigns. More zero-day vulnerabilities were discovered in 2013 than any other year, facilitating watering hole attacks against unpatched websites.