From the report, “How do we actually “play the hacker”? We do this by deploying simulators that play the role of a “virtual hacker” across endpoints, network and cloud, and execute breach methods from our hacker’s playbook. Our findings are incorporated in this report, and analyzed by SafeBreach Labs, with the hope that security teams can glean some interesting insights into the things not to do in their environment.”

To shine a light on the availability of SSL/TLS certificates on the dark web, the Evidence-based Cybersecurity Research Group at the Andrew Young School of Policy Studies at Georgia State University and the University of Surrey spearheaded a research program, sponsored by Venafi. This report details the preliminary findings of the research and outlines the volume of SSL/TLS certificates for sale on the dark web, including information on how they are packaged and sold to attackers. These certificates can be used to eavesdrop on sensitive communications, spoof websites, trick consumers and steal data. The long-term goal of this research is to gain a more thorough understanding of the role SSL/TLS certificates play in the economy of the dark web as well as how they are being used by attackers.

This report takes a specific look back at connected medical device events that occurred in 2017.

This paper demonstrates vulnerabilities that affect numerous traders. Among them are unencrypted authentication, communications, passwords, and trading data; remote DoS that leaves applications useless; trading programming languages that allow DLL imports; insecurely implemented chatbots; weak password policies; hardcoded secrets; and poor session management. In addition, many applications lack countermeasures, such as SSL certificate validation and root detection in mobile apps, privacy mode to mask sensitive values, and anti-exploitation and antireversing mitigations.

This year, NopSec predicts that the biggest cyber threats will be massive data breaches, ransomware, opportunistic crypto-mining attacks and IoT hacking.

From the report, “All three of our stories in this issue of the State of the Internet / Security report are about things most organizations aren’t examining. Whether the cause is that organizations don’t perceive some issues as important to their environment, if they don’t have tooling to monitor these issues, or if the resources to monitor this traffic are not available, this traffic is often being overlooked.”

From the report, “For years, the Finance industry has been a trailblazer in managing the risk posed by vendors, suppliers, and business partners. As we have also detailed in previous BitSight Insights reports2 over the last four years, this industry has maintained a strong security posture in comparison to others. Given that the Finance industry is a leader in managing third-party cyber risk, how secure is their supply chain, and where do weak links lie? Are the companies in their supply chain meeting the same security standards they hold for their own organization? These questions are relevant not only for Finance organizations, but for all organizations that need to reduce third-party cyber risk. To answer these questions, BitSight researchers looked at the security performance of more than 5,200 Legal, Technology, and Business Services global organizations whose security ratings are tracked and monitored by hundreds of Finance firms using the BitSight Security Rating platform. The organizations across these industries represent a set of critical vendors and business partners in Finance’s supply chain, consisting of: legal organizations, accounting and human resources firms, management consulting and outsourcing firms, and information technology and software providers.”

From the report, “A growing list of contractors and subcontractors have disclosed that they have been victims of data breaches resulting in the compromise of sensitive government information. In response, U.S. federal agencies have or are considering expanding cybersecurity requirements for their contractor base and adopting best practices for evaluating and monitoring those entities. In a recent study, BitSight found a large gap in the security posture between financial organizations and their third parties. This BitSight Insights report explores a similar question: what is the cybersecurity performance of U.S. federal contractors, and how does that compare to the performance of U.S. federal agencies?”

The State of Payment Processing & Fraud: 2018 Inaugural Survey & Report is a first-of-its kind study brought to you by Kount and The Fraud Practice. The inaugural survey reached hundreds of acquirers, processors, gateways, payment facilitators and issuers to get their take on the state of the industry and what is most critical for attracting and retaining clients and growing processing volumes.

The State of Chargebacks: 2018 Report, brought to you by Kount and Chargebacks911, is intended to provide an overview of the health and status of chargeback management in the Card Not Present (CNP) payments space. It includes key facts and figures about chargebacks, dispute and win rates. In addition, participating organizations shared insights about the tools, services, and solutions they employ for fraud detection and chargeback management, as well as the greatest challenges they face.

From the report, “The 2018 Mobile Payments and Fraud Survey marks the sixth consecutive year of this study. This year’s report, with nearly 600 merchant respondents, is focused on understanding the growth, challenges and developments in the mobile channel. The report also set out to provide a better understanding of how the mobile market has evolved since the inaugural survey report in 2013.”

This report examines trends in vulnerabilities, exploits and threats in order to better align your security strategy with the current threat landscape. Incorporating such intelligence to vulnerability management programs begins to put vulnerabilities in risk–based context and helps to focus remediation on vulnerabilities most likely to be used in an attack. This is an update to a report published in January 2018 to reflect mid–year trends. All statistics for 2018 reflect data from the first half of the year — January 1, 2018 through June 30, 2018.

The 2019 Vulnerability and Threat Trends Report examines new vulnerabilities published in 2018, newly developed exploits, new exploit–based malware and attacks, current threat tactics and more. Such analysis helps to provide much needed context to the more than 16,000 vulnerabilities published in the previous year. The insights and recommendations provided are there to help align security strategies to effectively counter the current threat landscape. Incorporating such intelligence in vulnerability management programs will help put vulnerabilities in a risk based context and focus remediation on the small subset of vulnerabilities most likely to be used in an attack.

In 2016, Rapid7 Labs launched the National Exposure Index in order to get a measurable, quantitative answer to a fairly fundamental question: What is the nature of internet exposure—services that either do not offer modern cryptographic protection, or are otherwise unsuitable to offer on the increasingly hostile internet—and where, physically, are these exposed services located? Now in our third year, we continue this ongoing investigation into the risk of passive eavesdropping and active attack on the internet, and offer insight into the continuing changes involving these exposed services. We’ve also added a third dimension for exposure, “amplification potential,” in the wake of the disastrous memcached exposure uncovered in 2018.

Online Journey Hijacking, a client-side phenomenon where unauthorized ads are injected into consumer browsers, is a growing yet invisible problem for eCommerce sites. This issue is widespread across the web — yet the eCommerce industry has only been made aware of its existence in recent years.

From the report, “Technology has dramatically changed the online experience for consumers — and along with this their expectations. Be it for business or pleasure, digital platforms continue reshaping the way consumers interact and engage with each other, as well as with online brands. This new reality has made capturing consumer business and loyalty a bigger challenge than ever for eCommerce brands. With mobile usage higher than ever, today’s shoppers are constantly juggling their eCommerce experience with other activities. To better understand the state of contemporary consumers, we asked more than 1,300 online shoppers about their shopping habits, what online and offline distractions are competing for their attention, and what factors most influence them to embrace — or abandon — their online shopping experience. As a technology company with the mission of preserving a distraction-free online customer journey, we hope these insights help eCommerce businesses identify how to better optimize their customers’ online experience.” Read on to find out more.

From the report, “As the dust settles after the 2018 holiday shopping season, online retailers and eCommerce businesses will be diving deep into the results to measure just how effectively their online promotional campaigns capitalized on the opportunity - and translated increased traffic into more revenue and improved conversion rates. Just what type of impact did the holiday season have on eCommerce brands in 2018? What days stood out amongst the pack when it came to traffic, orders, and conversion rates? Which verticals saw their KPIs rise the most? To uncover top holiday season eCommerce insights, Namogoo analyzed hundreds of millions of web sessions across regions, devices, and verticals.”

For this report, Menlo Security’s researchers analyzed the top 100,000 domains as ranked by Alexa to understand the risks inherent in using the world’s most popular websites. We found widespread evidence that cybercriminals are successfully exploiting long-held measures of trust, such as a particular site’s reputation or the category in which the site is included, to avoid detection and increase the effectiveness of their attacks.

The DataVisor Fraud Index Report: Q1 2018 is based on attacks that were detected by the DataVisor UML Engine from January through March of 2018, analyzing 40 billion events and 680 million user accounts. This report provides unprecedented insights into the attack techniques that bad actors use to engage in malicious activities and evade detection.

The Q3 2018 Fraud Index Report, produced by the DataVisor Research Team, analyzes recent fraud attacks impacting consumers and organizations for the period July - September 2018.

From the report, “Threat actors are increasing their use of fileless malware for one simple reason: most organizations aren’t prepared to detect it. Education is the first step in determining what threat these new attacks pose and what IT and security teams can do to detect and stop fileless malware attacks. READ THIS PAPER to understand how fileless malware is quickly evolving to avoid detection, the techniques currently employed to prevent infection and the strategies security teams need to consider when determining how to stop future fileless breaches.”