The boom in information technology has led to a transformation which has been increasing in recent years due to the widespread adoption of Internet and mobile devices. Individuals and companies are all are imbued with ‘digital life’, which now defines the way we act, buy, work… the way we live. This reality has also marked a before and after in another sector:  that of information security which is becoming more complex every day.

According to IDC, companies are becoming increasingly aware of the risks in the market – from an infection caused by one of the many existing malwares, now spread to any platform and device, to a persistent advanced threat – and almost 50 percent of the companies in Europe (45 percent to be exact) increased their security budgets in 2014. In fact, Spain is the third country in Europe where more companies have increased their investment in this area, just behind the United Kingdom and Germany. Moreover, according to Gartner, another major IT consultant, the fear of suffering targeted cyber-attacks is what is encouraging 40 percent of the largest companies to make far-reaching plans for 2018 to defend themselves against these risks. Plans which they currently lack and which go far beyond preventive controls such as firewalls, traditional antivirus and vulnerability management, and which follow a more global and integrated control of all security areas.

In this context, the way of buying and selling security has also changed radically. According to independent analysts in the ICT sector, companies no longer sell only security, which is just the necessary lever to sell anything related to technology: cloud, big data, Internet of Things, mobility… Let’s say security has become a ‘building block’ for almost every aspect. In fact, these macrotrends carry the most sophisticated formulas for information security. For example, big data and analytics allow behaviors to be modeled in order to prevent attacks.

More sophisticated and intelligent solutions offered as a service

In general, the market trend is to offer as a service the most sophisticated and intelligent security solutions.  Advanced security services, managed and based on the cloud system, are on the rise. As it is no longer possible to put up walls as in the past, we now have to protect companies from below, from the processor itself to the highest levels. In this new approach security must be seen as a more global concept which includes more aspects from communications to storage, passing through many more elements. The key to this more complex world is, on the one hand, that security is immersed in a complete cloud solution, and on the other, that it includes different capacities in order to provide a more comprehensive service.

The price of being safe

 With this more complex scenario with “the ‘baddies’ becoming increasingly ‘badder’ and smarter”, with the proliferation of more sophisticated attacks with different formats making them more difficult to stop, will companies have to invest more money to be safe? The answer is ‘no’. In fact prices have dropped in recent years, especially since the boom of the cloud based system. What happens is that now companies have to protect themselves against more threats. There is a new range of risks and this is why investments in security are becoming increasingly higher.

Obviously, the investment made by large corporations is still higher than that made by the smaller companies.  But at least, it seems that they are all starting to be aware that an attack can cost them a lot of money and can damage their image.  How they deal with it is another matter, but the awareness is there, and also at the highest level within the companies. Moreover, news about security is one of the few subjects in the IT world which makes the headlines in newspapers around the world. Still, as we said, SMB’s are the most vulnerable.  Unfortunately they are generally the least prepared and the main victims of many attacks.

With the Internet of Things the risks can be limitless

Another major risk looming on the horizon in this new digital scenario derives from the so-called ‘Internet of Things’. Given the growing proliferation of all kinds of sensors and gadgets such as the popular wearables, devices which we will all wear in the near future like watches or smart glasses  (many people already do this), and the unstoppable advance of the smartphone, the risks will constantly increase. The Internet of Things means bringing the digital into the physical world, and this will lead to endless security risks. Undoubtedly, with this trend there are many challenges ahead to overcome, not only with regard to safety, but also privacy, complying with the regulations, etc. Therefore, the Internet of Things makes the current situation even more complex, opening up at the same time interesting business opportunities which we should all exploit to the full.

The post Security challenges in the digital era appeared first on MediaCenter Panda Security.

We daily capture them on our phones. We have dozens of them stored on our computers. We share them on social networks and we love to see those of others. We are talking about the images in JPEG format, the most used one because when compressed the pictures don’t lose much quality. Indispensables, and yet, could be the tool used by a cybercriminal to access any corporate or institution network.

This was proven by security expert Marcus Murray, who researched a new way a cyber-attacker could exploit a malicious JPEG to compromise Windows servers and access any company’s sensitive information.

The researcher demonstrated how someone could performed this attack during the RSA Conference in San Francisco, an event that gathers dozens of experts in computer security every year. Murray implemented a ‘demo’ to compromise a similar security network to any US government agency network.

Murray changed the attributes or metadata that any JPEG file stores including in it a malicious code. Then he got this image to infect the corporate network. How did he do it? By a form that allowed users to upload a profile picture to the alleged government agency web page. Once inside, the file became a gateway for the attacker.

Thanks to the malicious JPEG, the cyber-criminal’s administration permissions over the network grew more and more, reaching a point at which he could steal sensitive information or even take control over the network.

The rest of the process is simpler: the criminal only has to exploit his advantage to install malicious software that infects the computers to spy the corporation or steal confidential information. According to Murray, this attack can be performed in “even mixed environments” with Windows and Linux.

On the conference in San Francisco, he showed how to introduce a remotely accessed Trojan he created using Metasploit, the popular open source project that allows trying different kinds of attacks as part of a ‘pentest’ (penetration test).

That’s how he prove that only with a picture you can access any company’s network and steal their confidential information, without the employees realizing the damage a file so seemingly harmless could make.

The post A JPEG may jeopardize your company’s network appeared first on MediaCenter Panda Security.