We’ve reported on a couple of them like back in December when the WikiLeaks Attacks Caused Rival DDoS Retaliation. There have been a whole lot of other attack types going as usual though with SQL Injection and XSS (Cross Site Scripting) making up the to the top 3 with DDoS Attacks.

But if you haven’t worried about it before, perhaps now is the time to look into prevention/protection against denial-of-service attacks.

Driven by the hacktivism of the loose-knit Anonymous group, denial-of-service attacks surged to the top of the list of Web incidents, outpacing SQL injection and cross-site scripting, according to a survey of publicly disclosed attacks.

The ongoing survey, known as the Web Hacking Incident Database, categorized 222 incidents in 2010 and found that attackers aimed to take down the Web sites in a third of the incidents, while defacement accounted for 15 percent of attacks and stealing information was the goal in 13 percent of incidents. Unsurprisingly, the popular goal of causing downtime meant that denial-of-service attacks accounted for about a third of attack types, followed by SQL injection (21 percent) and cross-site scripting (9 percent).

In many industry reports, denial-of-service is not even on the list, but companies should worry about such brute-force tactics, says Ryan Barnett, a senior security researchers with security firm Trustwave’s SpiderLabs, who manages the WHID project. “You need to re-prioritize because Web servers are actively being targeted with denial-of-service attacks,” says Barnett.

Simple tools like Slowloris can give even the most robust web sites a big headache. Of course you also have to make sure you are secured against SQL Injection and any other kind of web attacks that can comprise your up-time or data.

According to the data different industries need to be prepared for different kinds of attacks, obviously skilled attackers will focus different ways of compromising hosts in different sectors.

Yet, different industries should also worry about different types of attacks, he says. Attackers focus on stealing money from financial firms using stolen credentials, according to the WHID data. They also tend to focus on defacing government sites and stealing credit-card numbers from retailers, using SQL injection in both cases, according to the WHID. The latter two relationships are weaker, however: While those are the most popular goals for attackers, each only accounts for a bit more than a quarter of attacks against the particular vertical. Money is the goal in two-thirds of attacks against financials.

“The outcomes and attacks and weaknesses are different, so depending on what market you are in, we have a pool of attacks that worked,” says Barnett. “So CSOs should pick out examples in their market because those are most applicable to them.”

Attackers’ focus on downtime means that corporate CSOs need to make sure that they can handle Web-specific denial-of-service attacks. Many times such attack focus on flooding the Web servers, but low-and-slow attacks are becoming more popular and require a different defense.

“Many of these organizations foolishly think that the network security gear that they have to handle the lower level DOSing floods will take care of this and it won’t,” Barnett says. “The overall amount of traffic that you have to send to take down the Web server is a lot less, and it looks legitimate.”

Downtime has gotta be one of the worst types of attack, especially for e-tailers or online vendors. Yah theft of credentials is bad, but honestly – most of the time those attacks aren’t even disclosed and no-one knows about them.

And from what I’ve seen most companies seem to think sticking a mid-range firewall in front of whatever they are doing is the be all and end all of security – it’ll protect their applications, their data, their organisation…and so on.

How misguided they are.

Source: Network World

I find it a little surprising in this day and age that such a low percentage of IT managers believe data loss is a low impact issue.

Don’t they read the news? Don’t they understand how losing customer trust can really effect your bottom-line?

I would have thought 30% of respondents thinking data loss was high impact as a low figure, but 7%? That’s just insane.

A mere seven per cent of respondents to a survey on data management believed data loss has a “high” impact on a business.

This is one of the key findings of a survey launched in Hong Kong yesterday by Kroll Ontrack, a US-based provider of data recovery solutions. The survey was conducted earlier this year by StollzNow Research. It asked IT managers from 945 small, medium and large companies in Hong Kong, Singapore and Australia about their views and experiences related to data management.

The survey found that just less than half (49 per cent) of all IT managers have reported a data loss situation in the last two years.

Even more shocking is that half of the small business surveyed don’t even run back-ups! It’s so cheap and simple now with mass storage devices available off the shelf with Terabytes of storage.

There’s really no excuse for not backing up any more, I even had a 2TB RAID mirrored storage unit at home to back up my personal stuff. All my websites are backed up nightly and the backups sent to multiple physical servers and DB backups sent via e-mail.

While larger companies may not fully appreciate the risks they face with data loss, it is the small business sector that appears to be most at risk. An alarming 49 per cent of small companies stated that they fail to back up their data on a daily basis.

This is despite the fact that nearly half of all participants had experienced data loss in their workplace in the past two years, and 36 per cent felt that data loss could have a significant impact on their business.

Small businesses were also less likely to test their backup systems on a regular basis, or to have implemented a policy for the preservation of data. While 61 per cent of overall respondents reported that their company had a formalised data retention policy, this figure fell to just 45 per cent for companies with 50 or fewer employees.

I’d be interested to see a similar survey for the US and Europe to see if the figures are in the same kind of range.

It’s very common though for policies and backups to be implemented and never updated or tested. So when a failure actually occurs the company finds out their system isn’t even working.

Computers and backup systems don’t just keep magically working, especially when you’re changing configurations, server setups and software all the time.

Source: Network World