The UK’s critical infrastructure is vulnerable to DDoS attacks due to failure to carry out basic security defence work –  39 percent of respondents to a recent survey had not completed the government’s ’10 Steps to Cyber Security’ programme, which was first issued in 2012. New data was obtained by Corero Network Security under the Freedom of Information Act surveying 338 critical infrastructure organisations in the UK, including fire and rescue services, police forces, ambulance trusts, NHS trusts, energy suppliers and transport organisations; it also showed  that 42 percent of NHS Trusts had not completed the programme. More than half  (51 percent) of these critical infrastructure organisations were described by Corero as ignoring the risk of short, stealth DDoS attacks on their networks – which typically account for around 90 percent of DDoS attacks and are used by attackers to plant malware or ransomware, or engage in data theft.  Corero reports that these stealth attacks are typically  less than 30 minutes in duration, and 98 percent of those stopped by the company were less than 10Gbps in volume, hence they often go unnoticed by security staff, but are frequently used by attackers in their efforts to target, map and infiltrate a network. In a statement issued today, Sean Newman, director of product panagement at  Corero, comments: “Cyber-attacks against national infrastructure have the potential to inflict significant, real-life disruption and prevent access to critical services that are vital to the functioning of our economy and society. These findings suggest that many such organisations are not as cyber resilient as they should be, in the face of growing and sophisticated cyber threats.” Newman adds, “ By not detecting and investigating these short, surgical, DDoS attacks on their networks, infrastructure organisations could also be leaving their doors wide-open for malware or ransomware attacks, data theft or more serious cyber attacks.” It was also pointed out that in the event of a breach, these organisations could be liable for fines of up to £17 million, or four percent of global turnover, under the UK government’s proposals to implement the EU’s Network and Information Systems (NIS) directive, from May 2018. In an email to SC, David Emm, principal security researcher, Kaspersky Lab observed, “The world isn’t ready for cyber -threats against critical infrastructure – but criminals are clearly ready and able to launch attacks on these facilities. We’ve seen attempts on power grids, oil refineries, steel plants, financial infrastructure, seaports and hospitals – and these are cases where organisations have spotted attacks and acknowledged them. However, many more companies do neither, and the lack of reporting these incidents hampers risk assessment and response to the threat.” Edgard Capdevielle, CEO of Nozomi Networks, also emailed SC to comment: “This report emphasises the impact of DDoS attacks and how they are often used as a cover to distract security teams while infecting systems with malware or stealing data. Such initiatives are often the first step in “low and slow” attacks that provide the perpetrators with the information and access they need to carry out system disruptions. Examples of this are the Ukraine power outages of 2015 and 2016, both of which involved cyber-attacks which persisted for many months before culminating in shutdowns. “In light of this information, CNI organisations should give a high priority to re-assessing their cyber-security programmes, evaluate where they are in relation to government recommendations, and inform themselves about current technologies available for protection….The right approach is to both shore up defenses and be able to quickly respond when attacks do occur.” Previously, when talking about the new UK legislation targetting CNI, Eldon Sprickerhoff, founder and chief security strategist at eSentire commented in an email to SC, “Although cyber-security regulations will require significant effort for the companies that are affected, this new legislation by the UK government demonstrates that they understand the severity of cyber-threats in today’s digital world and the destruction they can cause, if undeterred.  Even if you’re not a CNI, cyber-threats should concern you. With cyber-criminals constantly adjusting their tactics, it is imperative that companies never stop defending themselves by constantly improving and expanding their cyber-security practices. Managed detection and response and incident response planning are common ways companies can stay ahead of their attackers.” Sprickerhoff recommended the same measures be taken by CNI organisations to improve cyber-security as for other enterprises, namely: Encryption – store sensitive data that is only readable with a digital key Integrity checks – regularly check for any changes to system files Network monitoring – use tools to help you detect for suspicious behaviour Penetration testing – conduct controlled cyber-attacks on systems to test their defences and identify vulnerabilities Education – train your employees in cyber-security awareness and tightly manage access to any confidential information  Source: https://www.scmagazineuk.com/critical-infrastructure-not-ready-for-ddos-attacks-foi-data-report/article/684838/

Visit link:
Critical infrastructure not ready for DDoS attacks: FOI data report