Cyber warfare advancing at a rapid rate

From state-sponsored malware attacks to credit card fraud, the online security landscape has altered dramatically in a very short space of time

Jonathan Evans, chief of the British Security Service MI5, last week revealed the "astonishing" levels of cyber-threats that industry is battling against in the United Kingdom. This admission was another example of how the current threat landscape is rapidly evolving, prompting many commentators to suggest that we are entering an era of cyber war – with attacks so advanced that they are increasingly evading detection and regularly claiming high-profile government and corporate victims. What is more, it is becoming clear that cyber espionage is no longer considered to be a hypothetical and far-off threat. It is now an alarming reality.

Indeed, Evans suggested that the target of cyber threats is shifting from unwitting consumers on their home personal computers to high pay-off hits; with MI5 investigating claims that one major London business has suffered £800m in losses following a breach. He also suggested that internet vulnerabilities were increasingly the target of nation states as well as cyber criminals, which further highlights the urgency of the situation.

In recent weeks, there have been several announcements from other high-profile organisations that also acknowledged the complexities of modern day threats - as well as the subsequent risks posed to their networks and customers. For instance, Google pledged earlier this month to warn all vulnerable Gmail account holders - including political figures, activists and so on - if their intelligence suggests that the users' account had been the target of a state-sponsored attack. The recent discovery of the Flame virus targeting Iranian information technology systems - which has been described as the most sophisticated computer virus in the world - also demonstrated the rapid emergence of sophisticated, next-generation malware.

High profile breaches, some of which coming as a result of state-sponsored malware, support the ongoing notion that we are tackling a new type of threat. For instance, within just 24 hours of Evans' speech, it was revealed that almost €60m was stolen from European banks as a result of a cyber-attack. With such incidents coming thick and fast, it is time that businesses and governments reassess current security polices to ensure that the assets that they are entrusted with remain secure at all times.

In the same way that unwitting individuals hold information that low-level hackers are eager to abuse - for instance, through credit card fraud - businesses and governments have vast amounts of intellectual property and sensitive information that today's cyber-criminals are targeting. As incidents become more visible to the public, the risk of copycat attacks that are extremely difficult to thwart increases. A realignment of security measures must happen sooner, rather than later.

It seems that cyber-attacks are becoming a new form of 'cold conflict', where nations are able to affect each other through indirect means. Reliance on the traditional signature and heuristics-based security defences only protect against known threats; leaving networks vulnerable to potentially disastrous zero-day and unknown attacks. Substantially more needs to be done to ensure that networks are being continuously monitored, in order to defend against attacks at an early enough stage to prevent widespread damage. Only when security measures are adapted and strengthened in order to meet the current threat level can this battle against a new breed of cyber criminals be successful.

Paul Davis is director of Europe at the FireEye consultancy firm