A historical overview of the cyberattack landscape
Over the past 16 years, sensitive data and the complex IT infrastructure within Global 2000 enterprises used to create, distribute, and protect it has grown exponentially. Data and the systems used to secure it have all become targets that are ripe for attack.
The worldwide cybercriminal community has grown and evolved to include a diverse cast of characters that include pranksters, lone wolves, organized gangs, nation states, and hacktivist groups.
Venafi released a new report that chronicles the last 16 years of attacks, threats and exploits, and analyzes how they’ve evolved and intensified over time. They also offer advice to enterprises on how to better defend against new attacks that increasingly leverage unprotected cryptographic keys and digital certificates.
Criminals have used every weapon in their arsenal — from malware to attacks on trust — in order to make a name for themselves, disrupt business, and steal data and state secrets.
As enterprises have responded, advanced attackers have had to develop new and more resistant attack and evasion methods. More recent persistent and targeted attacks demonstrated a range or attack methods and provided powerful blueprints for more common cybercriminals.
“State-backed and organized cybercriminals learned from early hackers that their vast resources could be used for a variety of nefarious, disruptive or lucrative activities. Common criminals looking for the path of least resistance have mimicked advanced attack methods. This, coupled with organizations’ failure to secure and protect keys and certificates has left the front doors open for attackers to enter at will and pilfer whatever sensitive data they want, whenever they want,” said Jeff Hudson, Venafi CEO.
“Organizations must stop blindly trusting keys and certificates, and take steps to understand how these attacks work and what they can do to defend against them. Otherwise, they are a vulnerable target to anyone with a cause, computer and Internet connection.”
Chronicled in the report are the different eras of attacks and attackers, with factual examples of attacks and exploits from each period, including overviews of the CIH computer virus, Melissa, Code Red, MD5, Aurora, Stuxnet and Flame.
Historical eras include:
- 1997-2003: Viruses and worms
- 2004-2005: The birth of for-profit malware
- 2007-2009: The rise of APTs
- 2010-Present: Assault on trust using key and certification-based attacks.
The complete report is available here (registration required).