EXECUTIVE SUMMARY
The month of August has seen some interesting developments in the world of cyber security.
The first item shows the substantial rise of credential-stealing phishing websites.
Also highlighted are the concerns from Cybersecurity and Infrastructure Security Agency (CISA) about quantum computers and current cryptography methods.
Finally, there have been some surprising new statistics about ransomware and malware attacks in H1 2022.
HUGE GROWTH IN PHISHING WEBSITE
There has been a significant increase in the abuse of website building platforms to create phishing websites that steal login credentials. According to a report by Palo Alto Networks, there has been a 1,100% increase from June 2021 to June 2022. Website builders are a popular choice, because they are highly available and avoid the need for coding experience to make a website that appears legitimate. Threat actors target victims by sending an email with a URL that leads to a seemingly official website. Often this website will lead victims to another website which contains the credential-stealing login form, so if the malicious page is reported and taken down, the threat actor can simply change the link on the first website to point to a new one. This issue will continue to rise, so it is good practice to learn to avoid clicking on links in emails. Instead use a search engine to find the official website to which the email is referring.
QUANTUM COMPUTER CONCERNS
CISA has emphasized the need to start preparing for quantum computers now. By the end of the decade, quantum computers will be in striking range of cracking asymmetric encryption such as RSA. This threatens our current cryptographic standards. When Quantum Computers reach a certain level of maturity, encryption methods that are considered secure today will be breakable in just a few seconds. This threatens the security of people, companies, and even entire countries. The National Institute of Standards and Technology (NIST) has been evaluating quantum safe alternative algorithms and has already identified the new standards. They plan to release official guidelines by the end 2024, but it is best to put a plan into action now given we know what these guidelines will likely say. As soon as possible, organizations should take inventory on all their systems using cryptographic technologies, and plan for a transition without waiting for the new guidelines to become available.
RANSOMEWARE AND MALWARE ATTACKS
A report from SonicWall shows that ransomware attacks globally have dropped by 23% in the first have of 2022. Unfortunately, ransomware attacks specifically targeting the healthcare industry have increased by 328% in H1 2022. This overall decrease in ransomware attacks may be due to government and law enforcement agencies targeting ransomware groups more seriously, but the war in Ukraine is a more likely disruption factor. While ransomware attacks are down globally, the same cannot be said for malware attacks, which have seen an 11% increase in H1 2022. The most notable target of these malware attacks has been Internet of Things (IoT) devices, which have seen a 77% increase since H1 2021.
.png)
.png)
.png)
