TechCentralTechCentral
    Facebook Twitter YouTube LinkedIn
    Facebook Twitter LinkedIn YouTube
    TechCentral TechCentral
    NEWSLETTER
    • News

      New Openview channels coming as platform turns profitable

      27 May 2022

      Wapa’s Paul Colmer on why Icasa should open up 6GHz for Wi-Fi

      27 May 2022

      How Broadcom’s blockbuster VMware deal happened

      27 May 2022

      The cost for South Africa to quit its coal habit: R4-trillion – study

      26 May 2022

      Apple is feeling the smartphone industry chill

      26 May 2022
    • World

      Musk sued by Twitter investors for stock ‘manipulation’

      27 May 2022

      Broadcom agrees to buy VMware for $61-billion

      26 May 2022

      Musk pledges more equity to fund Twitter deal

      26 May 2022

      Sony looks beyond the console to PC and mobile gaming

      26 May 2022

      Andreessen Horowitz raises world’s largest crypto fund

      26 May 2022
    • In-depth

      Bernie Fanaroff – the scientist who put African astronomy on the map

      23 May 2022

      Chip giant ASML places big bets on a tiny future

      20 May 2022

      Elon Musk is becoming like Henry Ford – and that’s not a good thing

      17 May 2022

      Stablecoins wend wobbly way into the unknown

      17 May 2022

      The standard model of particle physics may be broken

      11 May 2022
    • Podcasts

      Spectrum auction opens up big growth opportunities – Ruckus Networks

      26 May 2022

      Everything PC S01E03 – ‘The story of Intel – part 1’

      25 May 2022

      The rewarding and lucrative careers to be had in infosec

      23 May 2022

      Dean Broadley on why product design at Yoco is an evolving art

      18 May 2022

      Everything PC S01E02 – ‘AMD: Ryzen from the dead – part 2’

      17 May 2022
    • Opinion

      A proposed solution to crypto’s stablecoin problem

      19 May 2022

      From spectrum to roads, why fixing SA’s problems is an uphill battle

      19 April 2022

      How AI is being deployed in the fight against cybercriminals

      8 April 2022

      Cash is still king … but not for much longer

      31 March 2022

      Icasa on the role of TV white spaces and dynamic spectrum access

      31 March 2022
    • Company Hubs
      • 1-grid
      • Altron Document Solutions
      • Amplitude
      • Atvance Intellect
      • Axiz
      • BOATech
      • CallMiner
      • Digital Generation
      • E4
      • ESET
      • Euphoria Telecom
      • IBM
      • Kyocera Document Solutions
      • Microsoft
      • Nutanix
      • One Trust
      • Pinnacle
      • Skybox Security
      • SkyWire
      • Tarsus on Demand
      • Videri Digital
      • Zendesk
    • Sections
      • Banking
      • Broadcasting and Media
      • Cloud computing
      • Consumer electronics
      • Cryptocurrencies
      • Education and skills
      • Energy
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Motoring and transport
      • Public sector
      • Science
      • Social media
      • Talent and leadership
      • Telecoms
    • Advertise
    TechCentralTechCentral
    Home»Sections»Information security»Skybox research reveals a perilous threat landscape

    Skybox research reveals a perilous threat landscape

    Information security By Skybox Security12 May 2022
    Facebook Twitter LinkedIn WhatsApp Telegram Email

    The latest Skybox Vulnerability and Threat Trends Report is now out, and it presents some eye-opening statistics and trends that security analysts at Skybox Research Lab have been tracking over the past year. For anyone interested in the on-the-ground realities confronting security professionals these days, the report makes for compelling reading.

    Get the 2022 report here

    This year’s findings chart a threat landscape that’s expanding and diversifying at a blistering clip. We observed record growth in new vulnerabilities affecting a wide variety of products. In particular, vulnerabilities in operational technology (OT) skyrocketed, nearly doubling versus the previous year. As vulnerabilities emerged, threat actors moved ever more quickly to weaponise them. New exploits increasingly took aim at the latest vulnerabilities, while malware producers nimbly tuned their product mix to capitalise on cybercrime hotspots such as cryptojacking and ransomware. Let’s take a closer look at our key findings:

    Vulnerabilities have more than tripled over the past 10 years

    Source: Skybox Security

    New vulnerabilities smashed records, hitting an all-time high in 2021, with 20 175 new CVE (common vulnerabilities and exposures). That’s up 10% from 2020 — the biggest percentage jump we’ve seen since 2018 and the first time new vulnerabilities have topped 20 000 for a single year.

    This latest crop of vulnerabilities adds to a mountain of accumulated security debt. The total number of CVEs published over the last 10 years reached 166 938 in 2021 — a three-fold increase over a decade.

    OT vulnerabilities nearly double in one year

    As rapid as the rise in overall vulnerabilities was, security flaws in OT products grew even faster, increasing by 88% year over year. These vulnerabilities are especially worrying given the precarious state of OT security. The number of OT devices deployed in enterprises has risen dramatically in recent years. Many of these systems have few or no cybersecurity controls in place and are increasingly connected to networks, exposing them to attacks. Learn how Skybox “scan less” vulnerability detection helps you find “unscannable” OT vulnerabilities.

    Cryptojacking and ransomware top new malware charts

    Malware producers are turning out a widening array of products and services keyed to the latest cybercrime trends. The number of new cryptojacking and ransomware programs grew by 75% and 42% respectively, reflecting a growing demand for these increasingly lucrative and popular forms of exploit. Easy-to-use malware, exploit kits and malware-as-a-service (MaaS) have made it remarkably simple for non-expert hackers to mount attacks and reap rapid financial returns.

    Faster weaponisation of vulnerabilities

    One of the more notable trends we identified is the shrinking interval between the appearance of vulnerabilities and the development of exploits designed to take advantage of them. We found 168 vulnerabilities that were published in 2021 and targeted by exploits within the same year. That’s 24% more than the number of vulnerabilities published and subsequently targeted by exploits in 2020. It’s another sign that threat actors are upping their game and moving more aggressively to cash in on emerging opportunities.

    Among those newly discovered vulnerabilities that were promptly exploited is the notorious Log4Shell vulnerability — a flaw in the massively popular Log4j open-source library that’s used in hundreds of millions of devices. The Log4Shell vulnerability was publicly disclosed in early December 2021. By the end of the month, there were already known 15 malware programs designed to exploit it.

    As vulnerabilities mount, attacks follow

    These trends leave security teams between a rock and a hard place. Proliferating vulnerabilities are creating more opportunities for breaches, and new malware and exploits are making it easier than ever for bad actors to capitalise on those opportunities.

    It’s a worst-of-both-worlds combination, emboldening threat actors and leading to more frequent and more audacious cyberattacks. In 2021 we witnessed some of the most brazen incidents to date:

    • Zero-day attacks more than doubled in 2021⁠1. A series of zero-day attacks exploited vulnerabilities in Microsoft Exchange Server, impacting tens of thousands of organisations.
    • Supply-chain attacks, such as those targeting IT software from SolarWinds and Kaseya, as well as the Log4Shell vulnerability.
    • Critical infrastructure attacks, wreaking havoc on vital operations and services. Examples include the Colonial Pipeline ransomware attack that disrupted fuel supplies in the south-eastern US.

    The average cost of data breaches hit $4.24-million, up nearly 10% from 20202

    Source: Skybox Security

    Clearly the old vulnerability management playbook that many organisations still rely on is badly out of step with today’s threat landscape. Traditional, reactive measures such as scanning and patching are too little, too late in a world where the attack surface is exploding, vulnerabilities are rampant (and are often difficult or impossible to scan and patch), and threat actors are increasingly aggressive. It’s time to get out of reactive mode and embrace a truly proactive security posture.

    In future instalments of this series, we’ll dive deeper into the report’s findings and discuss what they mean for the future of vulnerability management. Subscribe to our blog to catch the latest.

    Learn more about the Skybox Research Lab.

    References

    1. 2021 has broken the record for zero-day hacking attacks, Technology Review, MIT, September 23, 2021.
    2. 2021 Cost of a Data Breach Report, IBM, July 28, 2021.
    • This promoted content was paid for by the party concerned
    Skybox Skybox Security
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email
    Previous ArticleHelm goes global with Dr. Oetker
    Next Article Vodacom affiliate Safaricom optimistic about Ethiopia licence despite delays

    Related Posts

    New Openview channels coming as platform turns profitable

    27 May 2022

    Wapa’s Paul Colmer on why Icasa should open up 6GHz for Wi-Fi

    27 May 2022

    Musk sued by Twitter investors for stock ‘manipulation’

    27 May 2022
    Add A Comment

    Comments are closed.

    Promoted

    Financial advisers: manage your commission and analyse revenue effortlessly

    27 May 2022

    BT, MTN Business form strategic alliance in Africa

    26 May 2022

    Think like a start-up: how to build a competitive digital enterprise

    26 May 2022
    Opinion

    A proposed solution to crypto’s stablecoin problem

    19 May 2022

    From spectrum to roads, why fixing SA’s problems is an uphill battle

    19 April 2022

    How AI is being deployed in the fight against cybercriminals

    8 April 2022

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2022 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.