Today's Lesson: End Users in the Education Sector Are Twice as Likely to Visit Malicious Sites
Posted: 07 Jul 2015 10:45 AM | Sindyan Bakkal |
The threat landscape today is both dynamic and diverse. On one end of the spectrum are mass infections and threats that, while not very sophisticated, cast a wide net. On the other hand, we have very advanced targeted threats that are crafted painstakingly with a single target in mind, and executed over multiple stages possibly over a long period of time. Whatever the type of attack, it is clear that cybercrime is a business, and attackers are utilizing all marketing concepts like segmentation and targeting to zone in on their victims of interest.
Just like other aspects of the web are dynamic and targeted to you, such as your location, browser type, and browsing history, to maximize the chances of being relevant to you, malware targets its victims using multiple factors. It doesn't have to be custom crafted or targeted at a single entity, but can be targeted automatically at dynamic subgroups—for example, specific industries, and geographies.
The industry (sector) and nature of business play a key role in the type of threats malware uses to target its victims. Using Threat Galaxies to cluster a variety of indicators across diverse threat channels, we found some very interesting behavior. As we clustered our telemetry data gathered via our Websense® ThreatSeeker® Network and the Websense Advanced Classification Engine by type of threat, we saw a thick cluster of injection in every high level Threat Galaxy. Injection is a generic term for a class of attacks that rely on injecting data into web applications in order to facilitate the execution or interpretation of malicious data in an unexpected manner. It falls into the lure stage of the attack kill chain.
To illustrate how attacks are targeted by industry (or sector), let's take a journey into our latest Threat Galaxy, (shown below) that encompasses all industries and threats. Specifically as a case study, the dominant green cluster represents compromised websites that have been injected with malicious elements.
Isolating the education sector by coloring it in the same color as injection in the second graph below, we see that the majority of the users that visited compromised websites (colored green in the first graph) are from the education sector.
Clearly, users in the education sector are more likely to visit compromised websites. Additionally, according to our study based on the large sample set, users in the education sector are:
- 20 times more likely to encounter websites impacted by BlackHat SEO than any other sector.
- Twice as likely to visit malicious websites.
- Twice as likely to be impacted by Spyware / Adware.
Another interesting point to note from the sample set study is that although users from the education sector display more risky behavior in terms of visiting compromised websites, some threats are less likely to descend further down the attack kill chain for these users. A specific case that illustrates that different threats affect different industries is highlighted in our Websense Security Labs™ 2015 Financial Services Drill-Down report where we found that the Financial Services sector sees 400 percent more attacks using Geodo than other industries see. On the other hand, users in the education sector are hardly ever impacted by Geodo.
In terms of behavior profiling, we find that users in the education sector are three times as likely to visit websites on topics, such as cultural and religious institutions, political organizations, supplements and unregulated compounds. Clearly this behavior also affects the threats they are impacted by. All traffic is not created equal—certainly not to attack infrastructure. There are multiple factors that have a role to play in terms of which threats impact which victim, and the data shows that the company you keep does matter in how likely you are to have your valuable assets breached by a threat. The lesson for organizations is to keep a close watch on the threats affecting other organizations in the same or similar industry and to look for indicators of compromise in their environment that target such organizations.
Contributors: Amy Steier, Ruchika Pandey, and Rajiv Motwani
^ed
No comments:
Post a Comment