Story image

Businesses are more aware of cybercrime but still not prepared

29 Mar 2018

New research has emerged that reveals better cybersecurity awareness doesn’t necessarily mean better preparation.

Commissioned by SolarWinds MSP and undertaken by the Ponemon Institute, the study asked 202 senior-level security executives in the US and the UK about emerging security threats.

Specifically, the study addressed those propagated by the “Vault 7” leaks, and the more massive global WannaCry and Petya ransomware attacks fueled by the “EternalBlue” Shadow Brokers leak.

Despite the majority being in agreement that cyberattacks are on the rise, most are confused about what threats pose the most risk as well as lacking the means to defend against them.

Less than half (45 percent) said they had the technology to prevent, detect and contain cybersecurity threats, while just 47 percent felt that they had enough budget.

While 69 percent of respondents had a high awareness of both WannaCry and Petya threats, they were far less aware of the potential of Vault 7 threats, with the highest level of awareness at 30 percent.

“The lack of knowledge among senior-level security executives is worrying—they know that attacks are on the increase, but many don’t know what they are and seem unable to effectively prevent them,” says Ponemon Institute founder Larry Ponemon.

“Better use needs to be made of the resources available, such as US CERT alerts, and the service providers that most businesses are using to outsource protection. Those providers also need to step up and provide education on where most attacks are coming from and how they can be prevented.”

Potentially even more worrying than the confusion over risk was the actual number of attacks that had been detected, with 54 percent admitting that their businesses had experienced an attack in the last year. Of those, 47 percent had been unable to prevent the attack.

The result of these successful cyberattacks included the theft of data assets (52 percent), the disruption to business process (47 percent), and IT downtime (41 percent).

Some of the other findings include:

  • 29 percent said that they would be unable to prevent a Petya attack and 28 percent would be unable to prevent a WannaCry attack
  • Businesses are even less prepared for Vault 7 exploit attacks, with only 9 percent ready to prevent exploits of Vault 7 threats like Dark Matter or After Midnight
  • 44% of respondents who were aware of the WannaCry patch didn’t implement it
  • 55% didn’t patch for Petya

“There is a role for managed service providers (MSPs) to play based on this research, by supporting companies as they navigate the ever-evolving security threats businesses face. It’s a bit like the wild west now, as we saw from the widespread fallout from WannaCry and Petya, and may still see from Vault 7 if those leaks are more widely exploited,” says SolarWinds MSP VP of security architecture Tim Brown.

“Indeed, we have no crystal ball to know what threats lie on the horizon. Businesses need help with everything from awareness to technology to specialized staff. This study supports a view that MSPs have a unique opportunity to expand their security offerings to meet this need by filling gaps that can’t be easily filled in house.”

Norwegian aluminium manufacturer hit hard by LockerGoga ransomware attack
“IT systems in most business areas are impacted and Hydro is switching to manual operations as far as possible.”
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
Ransomware’s decline equals cryptomining’s rise
ESET’s Security Days Conference recently took place to go over the current threat environment and what to look out for next.
IoT and DDoS attacks: A match made in heaven
A10 Network’s Adrian Taylor uses findings from a number of reports to illustrate his point that advances in technology are facilitating cybercrime.