blog.barracuda.com Open in urlscan Pro
4.234.25.19 Public Scan

Back to summary

URL:
https://blog.barracuda.com/2023/06/08/how-attackers-defenders-learn/
Submission: On June 09 via api (June 9th 2023, 2:12:13 am UTC) from TR — Scanned from GB

Form analysis
1 forms found in the DOM

GET https://blog.barracuda.com/search

<form method="GET" class="cmp-search-box__form" action="https://blog.barracuda.com/search">
  <input class="cmp-search-box__form__input" type="search" name="searchTerm" aria-label="Search for" placeholder="Search" value="" data-cmp-hook-header="searchInput">
  <a href="#" class="cmp-search-box__form__search-btn" aria-label="Search" data-cmp-hook-header="searchSubmit">
        <span class="cmp-search-box__form__search-btn__icon"></span>
    </a>
</form>

Text Content

* Home
* Ransomware Protection
* Email Protection
* Research
* Remote Work

TYPE AND PRESS ENTER TO SEARCH

BEND, DON’T BREAK: HOW ATTACKERS AND DEFENDERS LEARN FROM EACH OTHER

Topics:
Jun. 8, 2023
|
Adam Khan
Tweet
Share
Share
Tweet
Share
Share

For more than 30 years, cyber attackers and security teams have battled it out
across the digital landscape, one side looking for gaps and flaws to target, the
other side fixing and protecting them. The pace of the conflict is accelerating.
Today, there are more than 1 billion known malware programs. Of these, 94
million appeared in the last 12 months. In 2009, the annual figure was 25
million.

To mark Barracuda’s 20th anniversary, we took a high level look at how
cyberattacks and cybersecurity have evolved since we started in 2003, and what
might be waiting round the corner.

THE LANDSCAPE BY 2003

Cyberthreats and the cybersecurity to defend against them took off in the mid
1980s. The Cascade virus in 1987/8, the Morris worm in 1988, the Melissa virus
in 1999, to name a few.

By 2003, cyberthreats had begun to diversify and multiply, but attacks remained
largely fragmented, disruptive, and often opportunistic. Viruses, worms, and
other malware took advantage of the rise in business internet use but were not
really implemented as part of organised cybercriminal attack campaigns. The
attacks targeted laptops and desktop devices and looked for cracks in a defined
and controlled access perimeter.

The corresponding cybersecurity landscape was focused on scanning for and
detecting known malware by its signatures and on blocking spam, viruses, and
basic web attacks. The static signature detection system was soon complemented
by heuristic detection (detecting viruses by examining code for suspicious
properties) designed to spot the growing number of previously unknown malware
variants.

Waiting in the wings, however, was the first push-enabled BlackBerry handset
released in 2022 — freeing employees and data from the traditional confines of
the workplace. It wasn’t long before other devices, technologies, and
applications followed, and everything changed forever.

BY 2009

By 2009, mobile devices, services and software were taking over the business
landscape. The security perimeter stretched ever further outwards, and attackers
got organised. Financial fraud, phishing, ransomware, spyware, botnets, and
denial of service (DoS and DDoS) joined the cyberthreat ecosystem — and didn’t
leave. Some of the attack tactics first reported during this time — such as SQL
injection - are still in use today.

To cope with larger and more varied digital workloads, virtual machines (VM) and
virtualisation became integral components of IT networks. It can be harder to
keep track of workloads and applications in a virtualized environment as they
migrate across servers, which makes it more difficult to monitor security
policies and configurations. Under-protected VMs can be targeted with malware
and, once infected, can spread malware across the entire virtual infrastructure.
Virtualization also offered some security advantages. If a VM is isolated from
the wider network it can be used for malware analysis, penetration- and
scenario- testing.

BY 2012

The age of modern ransomware had arrived. Web-based and social engineering
attacks became widespread, and attacks by nation-state supported groups and
hactivists increased.

At the same time, the business need for scalable, accessible, security that can
be updated in real-time and doesn’t drain resources drove security to the cloud
and as-a-service consumption models. Organizations also looked for security that
could store and protect their growing volume of cloud-hosted assets and for
advanced email security to combat the increasingly sophisticated email-based
attacks.

BY 2016

As the decade progressed, cyberattacks became more prolific and destructive.
Connected internet-of things (IoT) systems and hybrid cloud/on premise IT
environments become common, offering attackers a broader attack surface and new
points of weakness to target and exploit. Attackers were using fileless malware
and legitimate or built-in IT tools to bypass security measures and detection.

The skills and resources needed to secure complex digital environment against
such threats overwhelmed many organizations, and they turned in growing numbers
to managed service providers for external support. Security provision became
more flexible, available through the major online marketplaces and other service
providers so it could be bought and up and running within minutes.

2017 was to be a defining year for cyberthreats and cybersecurity. It was the
year the powerful exploit tool targeting the SMB protocol, EternalBlue was
leaked and the year of two attacks with vast global impact — WannaCry and
NotPetya.

BY 2023

Today, we see the internet-of-things evolving into the internet-of-everything
(IoE.) Security integration and visibility are struggling to keep pace — leading
to security gaps that attackers are quick to target and exploit.

Both attackers and defenders are harnessing AI and machine learning — the first
to craft ever more convincing social engineering attacks and malware; the second
to develop ever more intelligent security tools to detect and block these.

With malware tools and infrastructure widely available as-a-service,
cyberattacks are within the reach of many more criminals, powering the spread of
ransomware, extortion and more — and homing in on businesses with many users,
devices, applications, and data active far beyond what was once the perimeter.

Security has adapted, implementing single vendor, end-to-end network security
platforms that bring advanced security to the edge — known as Secure Access
Service Edge (or SASE) – with Zero Trust based access controls, threat
intelligence, incident response and 24/7 security operations centers.

The Russia-Ukraine war that started in 2022 has also reminded the world how
cyberattack tactics, such as DDoS, wipers, and more can be wielded as
cyberweapons in times of geopolitical tension.

BY 2028

What does the future hold?

As we move towards the second half of this decade, we know that security
perimeters are a thing of the past, and that attacks are more likely have
catastrophic results, simply because we have become so dependent on vast
interconnected digital systems and infrastructure. Security needs to be
embedded deeply into these systems.

We expect the widespread adoption of AI to continue, with significant
repercussions for businesses, society, and geopolitical stability. AI will
enable security operations centers to become intuitive and responsive,
accelerating the detection, understanding and mitigation of complex incidents.

By the end of the decade, quantum computing is expected to become commercially
viable, transforming everything from drug development and financial markets to
climate change and weather forecasting. Quantum computing will also have a
significant impact on cybersecurity, including the ability to crack traditional
encryption.

CONCLUSION

Cybersecurity is a journey. Looking back across 20 years shows us that attackers
and security teams have adapted continuously to the changing landscape and to
each other, both sides driving and driven by change. Over the coming years, the
pace of change will continue and accelerate. There will be new vulnerabilities
and new threats, alongside decades’ old tactics and weaknesses — security needs
to be ready for it all.

Adam Khan

Adam Khan is the VP, Global Security Operations at Barracuda MSP.
He currently leads a Global Security Team which consist of highly skilled Blue,
Purple, and Red Team members. He previously worked over 20 years for
companies such as Priceline.com, BarnesandNoble.com, and Scholastic. Adam's
experience is focused on application/infrastructure automation and security. He
is passionate about protecting SMBs from cyberattacks, which is the heart of
American innovation.

Related Posts:
Cybersecurity intelligence sharing needs to get better
U.S. discloses how FSB used snake to steal data
The language of data privacy: The differences between PII, PHI, NPI, and PCI
Cybersecurity Threat Advisory: Critical PaperCut vulnerability actively
exploited
Tweet
Share
Share
Tweet
Share
Share

--------------------------------------------------------------------------------

blog.barracuda.com Open in urlscan Pro 4.234.25.19 Public Scan

Form analysis 1 forms found in the DOM

GET https://blog.barracuda.com/search

Text Content

blog.barracuda.com Open in urlscan Pro
4.234.25.19 Public Scan

Form analysis
1 forms found in the DOM