Palo Alto Networks research shines spotlight on cyber threats hiding in plain sight

Palo-Alto-Networks-logoBangalore, India, June 3, 2014: Palo Alto Networks, the leader in enterprise security, today revealed new research on how attackers exploit commonly-used business applications to bypass security controls — and provides helpful insight into how business leaders and security practitioners need to reassess and strengthen their security posture.

The findings are based on analysis of traffic data collected from 5,500 network assessments and billions of threat logs over a 12-month spanand are revealed in the 2014 edition of the Palo Alto Networks Application Usage and Threat Report.The report provides the industry’s most detailed assessment of the relationship between advanced cyber threats and the applications running on enterprise networks worldwide. 

Key takeaways:

  • Common sharing applications such as e-mail, social media, and video remain favored vehicles for delivering attacks but are often the start of multi-phased attacks rather than the focus of threat activity.
  • 99 percent of all malware logs were generated by a single threat using UDP; attackers also use applications like FTP, RDP, SSL, and NetBIOS to mask their activities.
  • 34 percent of applications observedcan useSSL encryption; many network administrators are unaware of what applications on their networks use unpatched versions of OpenSSL, whichcan leave them exposed to vulnerabilities such as Heartbleed. 

Anil Bhasin, Managing Director, India and SAARC, Palo Alto Networks, said, “Our research shows an inextricable link between commonly-used enterprise applications and cyber threats. Most significant network breaches start with an application such as e-mail delivering an exploit.Then, once on the network, attackers use other applications or services to continue their malicious activity – in essence, hiding in plain sight. Knowing how cyber criminals exploit applications will help enterprises make more informed decisions when it comes to protecting their organizations from attacks.” 

In addition to the findings, the report includes actionable intelligence that security teams can use to better protect their networks, such as:

  • Deploy a balanced safe enablement policy for common sharing applications – key to the success of this recommendation is documentation of the policies, education of users, and periodically updating the policy.
  • Effectively control unknown traffic – every network has unknown traffic: small in volume, averagingonly 10 percent of bandwidth we observed, but high in risk. Controlling unknown UDP/TCP will quickly eliminate a significant volume of malware.
  • Determine and selectively decrypt applications that use SSL – selective decryption, in conjunction with enablement policies outlined above, can help businesses uncover and eliminate potential hiding places for cyber threats.

Leave a Reply

Your email address will not be published. Required fields are marked *