Publications
Partners
Singapore - A barrage of damaging cyber attacks is shaking up the security industry, with some businesses and organisations no longer assuming they can keep hackers at bay, and instead turning to waging a guerrilla war from within their networks.
US insurer Anthem last week said hackers may have made off with some 80 million personal health records. Also, Amy Pascal said she would step down as co-chair of Sony Pictures Entertainment, two months after hackers raided the company's computers and released torrents of damaging emails and employee data.
Such breaches, say people in the industry, offer a chance for younger, nimbler companies trying to sell customers new techniques to protect data and outwit attackers. These range from disguising valuable data, diverting attackers up blind alleys, and figuring out how to mitigate breaches once the data has already gone.
"Suddenly, the music has completely changed," said Udi Mokady, founder of US-based CyberArk. "It's not just Sony, it's a culmination of things that has turned our industry around."
Worldwide spending on IT security was about $70bn in 2014, estimates Gartner. ABI Research reckons cyber security spending on critical infrastructure alone, such as banks, energy and defence, will reach $109bn by 2020.
Attack methods
Several things are transforming the landscape. Corporations have been forced to allow employees to use their own mobile phones and tablets for work, and let them access web-based services like Facebook and Gmail from office computers. All this offers attackers extra opportunities to gain access to their networks.
And the attackers and their methods have changed.
Cyber criminals and spies are being overshadowed by politically or religiously motivated activists, said Bryan Sartin, who leads a team of researchers and investigators at Verizon Enterprise Solutions, part of Verizon Communications . "They want to hurt the victim, and they have hundreds of ways of doing it," he said in a phone interview.
The result: Companies can no longer count on defending themselves with decades-old tools like firewalls to block traffic and antivirus software to catch malware, and then assume all traffic that does make it within the network is legitimate.
Research by IT security company FireEye in January, for example, found that "attackers are bypassing conventional security deployments almost at will". Across industries from legal to healthcare it found nearly all systems had been breached.
"Once an attacker has made it past those defences they're in the gooey centre, and getting around is relatively simple," said Ryan Wager, director of product management at vArmour.
Attackers can lurk inside a network for half a year before being detected. "That's like having a bad guy inside your house for six months before you know about it," said Aamir Lakhani, security strategist at Fortinet, a network security company.
'Fake computers'
Security start-ups have developed different approaches based on the assumption that hackers are already, or soon will be, inside the network.
Canada-based Camouflage, for example, replaces confidential data in files that don't need it, like training databases, with fictitious but usable data. This makes attackers think they have stolen something worthwhile. US-based TrapX Security creates traps of "fake computers" loaded with fake data to redirect and neutralise attacks.
California-based vArmour tries to secure data centres by monitoring and protecting individual parts of the network. In the Target breach during the 2013 holiday shopping season, for example, attackers were able to penetrate 97 different parts of the company's network by moving sideways through the organisation, according to vArmour's Wager.
"You need to make sure that when you close the door, the criminal is actually on the other side of the door," he said.
