1. Cisco 2017 Security Annual Report
The Cisco 2017 Annual Cybersecurity Report presents our latest security industry advances designed to help organizations and users defend against attacks. We also look at the techniques and strategies that adversaries use to break through those defenses. The report also highlights major findings from the Cisco 2017 Security Capabilities Benchmark Study, which examines the security posture of enterprises and their perceptions of their preparedness to defend against attacks.
Cisco 2017 Security Annual Report

2. Cisco 2017 Security Capabilities Benchmark Study
To gauge the perceptions of security professionals on the state of security in their
organizations, Cisco asked chief security officers (CSOs) and security operations
(SecOps) managers in several countries and at organizations of various sizes about
their perceptions of their own security resources and procedures. The Cisco 2017
Security Capabilities Benchmark Study offers insights on the maturity level of security
operations and security practices currently in use, and also compares these results
with those of the 2016 and 2015 reports. The study was conducted across 13
countries with more than 2900 respondents.

3. Major Findings
Three leading exploit kits—Angler, Nuclear, and Neutrino—abruptly disappeared from the landscape in 2016, leaving room for smaller players and new entrants to make their mark.

4. Exploit kit
F-secure.com
trendmicro.com

5. Major Findings
According to the Cisco 2017 Security Capabilities Benchmark Study
most companies use more than five security vendors and more than five security products in their environment.
55% of the security professionals use at least six vendors
45% use anywhere from one to five vendors
And 65% use six or more products.
The top constraints to adopting advanced security products and solutions, according to the benchmark study are:
Budget (35%)
product compatibility (28%)
Certification (25%)
Talent (25%).

6. Major Findings
The Cisco 2017 Security Capabilities Benchmark Study found that, due to various constraints, organizations:
can investigate only 56% of the security alerts they receive on a given day.
Half of the investigated alerts (28%) are deemed legitimate
less than half (46%) of legitimate alerts are remediated.
44% of security operations managers see more than 5000 security alerts per day.

7. Major Findings
27% of connected third-party cloud applications introduced by employees into enterprise environments in 2016 posed a high security risk.
Open authentication (OAuth) connections touch the corporate infrastructure and can communicate freely with corporate cloud and software-as-a- service (SaaS) platforms after users grant access.

8. Major Findings
An investigation by Cisco that included 130 organizations across verticals found that 75% of those companies are affected by adware infections. Adversaries can potentially use these infections to facilitate other malware attacks.

9. Major Findings
Spam accounts for nearly two-thirds (65%) of total volume
Cisco research suggests that global spam volume is growing due to large and thriving spam-sending botnets
8% to 10% of the global spam observed in could be classified as malicious the percentage of spam with malicious attachments is increasing, and adversaries appear to be experimenting with a wide range of file types to help their campaigns succeed.

10. Major Findings
The Cisco 2017 Security Capabilities Benchmark Study also found that nearly a quarter of the organizations that have suffered an attack lost business opportunities
Four in 10 said those losses are substantial
One in five organizations lost customers due to an attack
30% lost revenue.
36% had their operations affected
26% Brand reputation and customer retantion

11. Major Findings Network outages that are caused by security breaches
45% of the outages lasted from 1 to 8 hours
15% lasted 9 to 16 hours
11% lasted 17 to 24 hours
41% of these outages affected between 11% and 30% of systems.

12. Major Findings
The cadence of software updates can affect user behavior when it comes to installing patches and upgrades. According to our researchers, regular and predictable update schedules result in users upgrading their software sooner, reducing the time during which adversaries can take advantage of vulnerabilities.
The 2017 Security Capabilities Benchmark Study found that most organizations rely on third-party vendors for at least 20 percent of their security, and those who rely most heavily on these resources are most likely to expand their use in the future.

13. VOLUME 22, APRIL 2017

14. Symantec Global Intelligence Network
98 million attack sensors
157 countries
Through a combination of Symantec products
And third parties
More than 88,900 recorded vulnerabilties
More than 20 years
24,560 vendors, 78,900 products

15. Summary Multi-million dollar virtual bank heists
Open attempts to disprupt the US elections
One of the biggest DdoS attacks on record using a botnet of IoT devices
Using very simple tools and tactics

16. Living off the land
“Only pre-installed software is used by the attacker and no additional binary executables are installed onto the system”
Symantec
Less new files → no trace → harder detection
Spear-phishing and social engineering
Categories
Memory-only
Filess persistence (Windows registry)
Dual-use tools (netsh, sc.exe)
Non-PE file (Portable Executable) (power shell script)

17. Fileless malware targeting US restaurants went undetected by most AV
By FIN7
It arrives in a Word document attached to a phishing
Contains attachments with names like menu.rtf, Olive Garden.rtf, etc
Convince the victim to exit “Protected View”
Javascript (obfuscated) copies malicious code into 2 files, stored in two distinct directories
The first malicious code creates a schedule Windows task that executes the second
The second starts up a powershell process
……..

18. Targeted attacks More overt activity with decline in covert activity
economic espionage, theft of intellectual property, and trade secrets
2015 agreement US/China
Designed to destabilize and disprupt organizations and countries
DNC attack and leak of stolen information
Disk-wiping malware was used against targets Ukraine and power outages
The trojan Shamoon reappeared after four years against multiple organizations in Saudi Arabia

20. Financial heists Cyber criminals focused mainly in customers
Now the attackers are targeting the banks
Up to millions of dollars in a single attack
Gangs
Carnabak, against US banks
Banswift, $81 US millions from Bangladesh’s central bank in fraudulent transactions
Odinaff, fraudulent transactions hiding customer’s own records of SWIFT messages relating to such transactions
Less sophisticated groups using BEC (Busisness Compromise) scams. More than $3 billion in the past three years

21. Emails Malicious emails were the weapon of choice
1 in 131 s sent were malicious
The highest rate in 5 years
Proven attack channel
It does not rely on vulnerabilities
Social enginnering to open attachments, follow links and disclosing credentials

22. Ransomware Continues to plague businesses and consumers
Indiscriminate campaigns with massive volumes of malicious s
Attackers are demanding more
From $294 in 2015 to $1,077 in 2016, in average

23. IoT and cloud Beginning to emerge as big threats Mirai
Ransomware and financial fraud still ahead
Mirai
Botnet composed of IoT devices (routers and cameras)
Weak security
The average IoT device was attacked once every two minutes