The Latest in Cyber Attacks

TL;DR

Mass attackers are shifting their focus from traditional targets like companies to individuals, who are easier and cheaper to attack.

Transcript

you are a conduit to every organization that you're connected to and so many attacks will start with you in your personal life and then move to the company thank you all right thank you okay so I've been in security industry for about two decades now and in that time I've given a lot of talk and security talks tend to be about scaring people and th... Read More

Key Insights

• 🎯 Mass attackers are shifting their focus from companies to individuals, who are easier targets and have less invested in personal security.
• 💰 The cybersecurity industry invests billions of dollars in technologies and personnel to protect devices and systems.
• 🛟 Attackers are attracted to targeting individuals because they serve as conduits to larger organizations.
• 👊 Attacks on individuals, such as symport attacks or phishing, are highly profitable and generate billions of dollars in revenues for attackers.
• 🔐 Security measures like using secure devices, password managers, security keys, and physical security methods can significantly enhance personal online security.
• 🛟 The increasing consumerization of sophisticated security technologies is providing individuals with effective tools to protect their digital lives.

Questions & Answers

Q: Why are mass attackers now targeting individuals?

Mass attackers are focusing on individuals because it is cheaper and easier to break into their personal accounts compared to companies and their expensive security measures. Individuals also serve as conduits to larger organizations.

Q: What are some examples of attacks on individuals?

One prevalent attack is symport or simjacking, where attackers convince telecom companies to transfer an individual's phone number to their devices. By gaining access to personal email accounts, attackers can then reset passwords for financial accounts and drain funds. Another attack method is phishing, where individuals are tricked into revealing their credentials on fake websites.

Q: How can individuals protect themselves from attacks?

Individuals can take several steps to enhance their online security. Using secure devices, employing a password manager, and using security keys are effective measures. Additionally, being cautious about physical security and considering the use of smart security cameras can further protect personal information.

Q: Are attacks on individuals more prevalent than attacks on companies?

Yes, attacks on individuals, including business email compromise and ransomware, are widespread. Small to medium-sized businesses, including home offices, are common targets. Attacks on individuals generate billions of dollars in profits for attackers.

Summary

This talk highlights a major shift in the security industry, where attackers are increasingly targeting individuals rather than companies and systems. The speaker emphasizes the importance of personal security, as individuals are often the gateway to broader attacks on organizations. The talk explores the financial investment in cybersecurity, the profitability of attacking individuals, and provides specific examples of prevalent attacks. The speaker then offers practical solutions at increasing levels of sophistication for individuals to protect themselves.

Questions & Answers

Q: What is the shift happening in the security industry?

The shift is moving attackers from traditional targets like companies and systems to individuals.

Q: How much money is invested in cybersecurity?

In 2018, approximately $5.3 billion was invested by venture capitalists. Large companies are estimated to invest over $100 billion in cybersecurity.

Q: How does the cost of breaking into devices compare to the amount spent on security?

Breaking into devices is expensive, with the price ranging from $2 million for an iPhone to $2.5 million for an Android phone. Companies spend a significant amount of money on security, making it challenging for attackers to breach their devices.

Q: How much do individuals typically spend on personal security?

The median price individuals spend on personal security is zero dollars.

Q: Why are individuals attractive targets for attacks?

Targeting individuals is cheap and profitable. Individuals are conduits to the organizations they are connected to, making attacks on personal accounts a starting point for broader attacks on companies.

Q: How much does it cost to take over a Gmail account?

It costs approximately $100 to take over a Gmail account. This account often contains valuable personal, academic, professional, and financial information.

Q: What is business email compromise?

Business email compromise refers to sending emails that trick recipients into sending money to illegitimate sources. This type of attack often targets individuals' personal accounts.

Q: Who are the primary targets of attacks like business email compromise and ransomware?

Small to medium-sized businesses, which can include individuals with home offices, are the primary targets of these attacks.

Q: How has phishing evolved in recent years?

Phishing attacks, which trick individuals into revealing their credentials, have become increasingly prevalent. Phishing sites now make up the majority of malicious sites observed by Google.

Q: Can personal security measures effectively protect against attacks?

Implementing basic security measures can provide significant protection against various attacks. This includes using secure devices, password managers, security keys, deception devices, physical security measures, and smart security cameras.

Takeaways

This talk highlights the shift in the security industry, where attackers are increasingly targeting individuals instead of companies and systems. Individuals' personal accounts are often the starting point for broader attacks on organizations. Implementing basic security measures, such as using secure devices, password managers, and security keys, can significantly enhance personal security. Physical security measures, including the use of safes and smart security cameras, can also play a crucial role. Individuals should take responsibility for their personal digital security to prevent attacks on themselves and their connected organizations.

Summary & Key Takeaways

• Mass attackers are now targeting individuals instead of companies and systems, which is a significant shift in the industry.

• Security is a multi-billion dollar industry, with companies and organizations investing heavily in protecting devices and systems.

• Attacks on individuals are cheap and highly profitable, as individuals are often connected to various organizations and can serve as gateways for broader attacks.