Report Reveals 2015 Attack Trends and Market Predictions for 2016, Including Increase in Bot Automation, Ransom Attacks, DDoS Frequency and Volume
Radware® (NASDAQ: RDWR), a leading provider of cyber security and application delivery solutions ensuring optimal service level for applications in virtual, cloud and software defined data centers, today announced the release of its Global Application and Network Security Report 2015-2016.
The annual report identifies the major attack trends of 2015, outlines industry preparedness, and offers predictions for 2016. Radware found that throughout 2015, no industry was immune to cyber attacks, and few were prepared. In 2016, attacks are predicted to become even more aggressive with the arrival of Advanced Persistent Denial of Service (APDoS) attacks and an increase in volume and scope of sophisticated bot-generated attacks against web application infrastructure.
"The front lines of information security will not include humans,” said Carl Herberger, vice president of security solutions at Radware. “As defenses continue to succumb to an endless flood of sophisticated, automated attacks and an infinite number of new attack techniques, the idea of humans having the ability to deploy detection technologies and choreograph responses in real-time will disappear. We are approaching the fall of human cyber defenses and the rise of cyber botted-defense."
Radware’s Emergency Response Team (ERT), which actively monitors and mitigates attacks in real-time, creates this annual report for use by the security community, drawing from their in-the-trenches experiences fighting cyber-attacks and the perspectives of third-party service providers. The report was compiled using a combination of data from a vendor neutral survey of more than 300 organizations and the expertise of the Emergency Response Team to provide the industry with insights and best practices to help prepare for 2016’s security landscape.
Key findings from the report include:
- Increase in Frequency of Ransoms: Attackers focus their Ransom demands toward service providers and leverage both DDoS and SSL Flood attacks when payment is not made.
- Wider and More Sophisticated Attack Modalities: Attacks are becoming completely automated and more sophisticated each day. New techniques like Burst Attacks, Advanced Persistent Denial of Service (APDoS), increase in volumetric pipe attacks, and Dynamic IP Attacks make it harder to defend against mostly manual solutions.
- Increased Attacks on Education and Hosting Industries. In 2015, several verticals faced consistent levels of threat, while both Education and Hosting moved from “Medium” to “High” risk on Radware’s Ring of Fire map. Organizations in these verticals are more likely to experience DoS/DDoS and other cyber-attacks and to experience such attacks at a higher frequency than in the previous year.
- A Growing Need for Security Automation. With a rise in APDoS and other volumetric pipe attacks, including the mimicking of user behavior and serving up dynamic IP addresses, there is an emerging threat that demands more advanced detection and mitigation,
- Over 90% Experienced Attacks in 2015. More than 90% of organizations reported experiencing attacks in 2015. Only one in 10 had not experienced any of the attacks covered in the report.
- The Enterprise is Still Not Prepared for Cyber-Attacks. While more than 60% are extremely/very well prepared to safeguard against unauthorized access and worm and virus damage, the same proportion of respondents indicated somewhat/not very prepared against advanced persistent threats (APT) and information theft. For distributed denial of service (DDoS), results split almost evenly between prepared and not prepared to protect against such attacks.
- Protection Gaps Were Identified Across the Board. One-third of respondents cited a volumetric/pipe saturation weakness, and another quarter cited vulnerability to network and HTTPS/SSL attacks. Overall weaknesses are spread fairly evenly, suggesting a true protection gap for most organizations today
“In 2015, cyber-attacks became the new normal, as 90% of organizations surveyed experienced them in varying degrees,” added Herberger. “Organizations should prepare for the challenges that will lie ahead in 2016, laying the groundwork now to fight back against new methods and motivation.”
Radware’s ERT recommendations include the following steps to anticipate and mitigate attacks:
- Bet on Bots and Automation. It is no longer realistic to believe humans can deploy detection technologies and choreograph threat responses in real time. Rather, it has become necessary to fight automated threats with automation technology.
- Cover the Blind Spot. To target an organization’s blind spot, attackers deploy parallel, multi-vector attack campaigns by increasing the number of attack vectors launched in parallel and targeting different layers of the network and data center. If only one vector goes undetected, the attack is successful and the result is highly destructive.
- Mitigate All Types of DDoS Attacks. Organizations need a single vendor, hybrid solution that can protect networks and applications for a wide range of attacks. A truly integrated solution includes all the different technologies needed, including DoS protection, behavioral analysis, IPS, encrypted attack protection and web application firewall (WAF).
- Understand the Likelihood and Cause of Attacks. Mitigation assumptions should move in lockstep with risk level. Whether it’s preparing for increased industry risk or being mindful to how hacktivists operate and select targets, understanding fuels preparation to mitigate risks and defend your network.
To download the complete Global Application & Network Security Report 2015-2016, which includes the ERT’s predictions and recommendations for how organizations can best prepare for mitigating cyber threats in 2016, please visit http://www.radware.com/ert-report-2015/.
THIS PRESS RELEASE AND THE REPORT ARE PROVIDED FOR INFORMATIONAL PURPOSES ONLY. THESE MATERIALS ARE NOT INTENDED TO BE AN INDICATOR OF RADWARE'S BUSINESS PERFORMANCE OR OPERATING RESULTS FOR ANY PRIOR, CURRENT OR FUTURE PERIOD.
About Radware
Radware® (NASDAQ: RDWR), is a global leader of application delivery and cyber security solutions for virtual, cloud and software defined data centers. Its award-winning solutions portfolio delivers service level assurance for business-critical applications, while maximizing IT efficiency. Radware’s solutions empower more than 10,000 enterprise and carrier customers worldwide to adapt to market challenges quickly, maintain business continuity and achieve maximum productivity while keeping costs down. For more information, please visit www.radware.com
Radware encourages you to join our community and follow us on: Facebook, Google+, LinkedIn, Radware Blog, SlideShare, Twitter, YouTube, Radware Connect app for iPhone® and our security center DDoSWarriors.com that provides a comprehensive analysis on DDoS attack tools, trends and threats.
©2016 Radware Ltd. All rights reserved. Radware and all other Radware product and service names are registered trademarks or trademarks of Radware in the U.S. and other countries. All other trademarks and names are property of their respective owners.
Safe Harbor Statement
This press release may contain statements concerning Radware’s future prospects that are “forward-looking statements” under the Private Securities Litigation Reform Act of 1995. Statements preceded by, followed by, or that otherwise include the words "believes", "expects", "anticipates", "intends", "estimates", "plans", and similar expressions or future or conditional verbs such as "will", "should", "would", "may" and "could" are generally forward-looking in nature and not historical facts. For example, when we outline industry preparedness, and offer predictions for in we use a forward-looking statement. Because such statements deal with future events, they are subject to various risks and uncertainties and actual results, expressed or implied by such forward-looking statements, could differ materially from Radware's current forecasts and estimates. Factors that could cause or contribute to such differences include, but are not limited to: the impact of global economic conditions and volatility of the market for our products; changes in the competitive landscape; inability to realize our investment objectives; timely availability and customer acceptance of our new and existing products; risks and uncertainties relating to acquisitions; the impact of economic and political uncertainties and weaknesses in various regions of the world, including the commencement or escalation of hostilities or acts of terrorism; Competition in the market for Application Delivery and Network Security solutions and our industry in general is intense; and other factors and risks on which we may have little or no control. This list is intended to identify only certain of the principal factors that could cause actual results to differ. For a more detailed description of the risks and uncertainties affecting Radware, reference is made to Radware’s Annual Report on Form 20-F which is on file with the Securities and Exchange Commission (SEC) and the other risk factors discussed from time to time by Radware in reports filed with, or furnished to, the SEC. Forward-looking statements speak only as of the date on which they are made and, except as required by applicable law, Radware undertakes no commitment to revise or update any forward-looking statement in order to reflect events or circumstances after the date any such statement is made. Radware’s public filings are available from the SEC’s website at www.sec.gov or may be obtained on Radware’s website at www.radware.com.