The latest fast growing threat isn’t DDoS attacks, but DeOS attacks. According to the Cisco 2017 Midyear Cybersecurity Report (MCR), Cisco predicts the potential “destruction of service” (DeOS) attacks.

These could eliminate organisations’ backups and safety nets, required to restore systems and data after an attack. With the increasing adoption of Internet of Things, it continues to be a vulnerability that many hackers exploit. Businesses are increasingly bringing more operations online, increasing attack surfaces and the potential scale and impact of these threats. Recent IoT botnet activity suggests that some attackers may be laying the foundation for a wide-reaching, high-impact cyber-threat event that could potentially disrupt the Internet.

Cisco security researchers noted the evolution of malware during the first half of 2017 and saw that attackers increasingly require victims to activate threats by clicking on links or opening files. They are developing fileless malware that lives in memory and is harder to detect or investigate as it is wiped out when a device restarts. Attackers are relying on anonymised and decentralised infrastructure, such as a Tor proxy service, to obscure command and control activities.

Cisco also saw a resurgence of traditional attacks, such as spam, spyware, adware and new evolutions of ransomware.  The report shows that businesses are struggling to keep up with security measures. As part of its Security Capabilities Benchmark Study, Cisco surveyed close to 3,000 security leaders across 13 countries and found that across industries, security teams are increasingly overwhelmed by the volume of attacks.

To combat today’s increasingly sophisticated attackers, Cisco Security advises organisations to take a proactive stance in their protection efforts. Cisco suggests a few practices, including:

• Keeping infrastructure and applications up to date, so that attackers can’t exploit publicly known weaknesses.
• Battle complexity through an integrated defense. Limit siloed investments.
• Engage executive leadership early to ensure complete understanding of risks, rewards and budgetary constraints.
• Establish clear metrics. Use them to validate and improve security practices.
• Examine employee security training with role-based training versus one-size-fits-all.
• Balance defense with an active response. Don’t “set and forget” security controls or processes.