Security Report – QI Reveals User Attacks Increase by 300%

Microsoft reveals how hackers are succeeding

In their quarterly security report, Microsoft revealed a dismal reality for Quarter 1 (QI) of 2017: user attacks increased by over 300% on the Windows platform. The security report offers insight into issues that are being experienced both on a worldwide scale and within the United States specifically.

Microsoft highlighted some of the integral causes of this 300% rise:

1. Poor Passwords
2. Malicious and Unwanted Software
3. Phishing Scams

Although these three issues are a continued known security threat, users continue to fall prey to these threats, compromising themselves as well as the businesses they work for.

Poor Passwords

A common practice among most employees is their use of passwords that can be easily guessed, are weak, and do not contain random numbers and/or symbols. More often than not, users will use these same credentials for a multitude of other accounts. This nature is what makes them an easy target. In addition, the security report shows that hackers will use targeted phishing attacks as well as attempt to break third-party services in order to obtain credentials. Once they’ve obtained these credentials, they then try to reuse them across multiple services.

QI of 2017 shows an almost 300% rise in compromised credential breaches compared to Q1 of 2016 (as indicated by Figure 1 below).

In order to combat this issue, businesses must start enforcing more rules and regulations surrounding password creation and protection. By having users create unique passwords for each account, you can minimize the risk of suffering a full breach. Organizations must begin to train users how to create, and store passwords effectively to avoid this situation. By employing different alternative measures, such as two-factor authentication, you can ensure that the protection of your users and the company’s data is strengthened.

Malicious and Unwanted Software

In Microsoft’s security report, the company highlighted an increase in malicious and unwanted software that affected Microsoft users. The following were among some of the malicious software to affected users in Q1 of 2017: ransomware, malware, viruses, trojans, worms, password stealers, injectors, etc.

Topping the list for the most encountered malicious software worldwide was Trojans, led by the Win32/Xadupi trojan (see Figure 13 below).

In order to ensure that your users are staying protected, make sure that you provide a powerful antivirus and anti-malware software company wide. Make sure that you, or your IT team, are actively scanning your network automatically to detect any of these issues. In addition, implement a strong spam blocker and train all of your users to not open email attachments from unknown sources.

Phishing Scams

The security report also highlighted Phishing Websites as one of the threats encountered in Q1 of 2017. Phishing sites are fake websites made to look like real ones, and mimic their appearance in attempt to obtain credentials from users, account information, credit card information and more. The report showed that both online services as well as financial institutions were highly targeted during Q1 of 2017. Both of these sectors are continually targeted quarterly and annually (see Figure 28 below).

Phishing scams are a particularly interesting area due to the fact that various reports have showed that users are aware of phishing scams, but continue to click and give information anyway. The problem is this: many businesses do not train employees. Other businesses do provide employees guidelines, but fail to understand the reasons behind why their employees keep clicking. Companies must being training users at all levels because (believe it or not) your employees are an active part of your security protection (for more on this, click here and here).