In Cisco probe, misuse or compromise spotted on all firms' networks

Share this article:
College and university networks were 300 percent more likely to contain malware.
Cisco found misuse or compromise on 30 networks probed

After reviewing the domain name system (DNS) traffic of 30 of the world's largest multinational companies last year, Cisco found that all networks generated traffic to sites hosting malware.

The probe was carried out as a means of investigating DNS lookups originating from internal business networks, Cisco revealed in its 2014 Annual Security Report (PDF) released last Wednesday. The test was carried out throughout all of 2013.

While malicious traffic was detected on 100 percent of the international firms' networks, Cisco also saw that 96 percent of the networks specifically communicated traffic to hijacked servers, and that 92 percent transmitted traffic to web pages without content (which is often an indicator that a site is hosting malicious activity), the report said.

Cisco also detected traffic going to military or government websites – notably, at firms that usually don't do business with such organizations.

“Cisco has observed that such sites may be used because of the generally high reputation enjoyed by public or government organizations,” the report said. “Traffic to these sites may not be a definitive sign of a compromise, but for organizations that do not habitually do business with the government or the military, such traffic could indicate that networks are being compromised so that criminals can use them to breach government or military websites and networks.

“In spite of their best efforts to keep their networks free of malicious threats, all of the organizations Cisco examined during 2013 showed evidence of suspicious traffic,” the report added.

On Thursday, Levi Gundert, technical leader with Cisco's TRAC team, told SCMagazine.com in an interview that the findings were “surprising.”  

“I didn't expect 100 percent of those firms' networks to be exhibiting that kind of behavior," Gundert said. "It goes to the point that, it's not if you are going to be compromised, but how long it will take you to detect that compromise."

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

ISSA tackles workforce gap with career lifecycle program

ISSA tackles workforce gap with career lifecycle program ...

On Thursday, the group launched its Cybersecurity Career Lifecycle (CSCL) program.

Amplification DDoS attacks most popular, according to Symantec

Amplification DDoS attacks most popular, according to Symantec

The company noted in a whitepaper released on Tuesday that Domain Name Server amplification attacks have increased 183 percent between January and August.

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.