The Business Implications of Targeted Attacks


This map represents the extent of bot compromises across the Internet. The full range of available IPv4 addresses is shown, with major domains visible as spokes or slices from the central axis. Each colored dot represents bot activity to or from that group of addresses.

A wide range of business risks have proven very difficult to control via firewalls, intrusion detection/intrusion protection (IDS/IPS), network access control and other elements of basic network security infrastructure. These areas of concern include:

  • Click fraud
  • Phishing
  • Identity theft
  • Distributed Denial of Service (DDoS)
  • DNS redirection
  • Credit card theft
  • Spam
  • Transaction fraud
  • Data exfiltration

Any organization that continues to struggle with these challenges has probably been compromised by a targeted attack.
A targeted attack uses malicious code to communicate externally with organized, criminal elements. These threats can compromise systems via malware or social engineering. All of these attacks enable external control over systems which allow malicious third parties to take actions without the knowledge or permission of the local user or system administrator.
Bots and BotArmies are an excellent example of targeted attacks. The following demonstrates just how successful they are:

  • 11% of the systems connected to the Internet are likely to be compromised by bots
  • >80% of all spam originates from BotArmies
  • >60% of all Windows PCs are estimated to run bot malware
  • >80% of all malware contains bot malware
  • 75% of enterprises will be compromised with bot malware (evaded their traditional perimeter and host defenses)

In addition:

  • 40% existing malware evades antivirus
  • 80% of newly written malware defeats antivirus
  • Over 23% of tested systems using signature-based, updated protection were compromised by malware loaded into memory
These devices are, by definition, beyond the control of enterprise IT and network security staff. Without a targeted attack security solution in place, there is no easy means to identify or remediate the problem.