Story image

Businesses are more aware of cybercrime but still not prepared

29 Mar 2018

New research has emerged that reveals better cybersecurity awareness doesn’t necessarily mean better preparation.

Commissioned by SolarWinds MSP and undertaken by the Ponemon Institute, the study asked 202 senior-level security executives in the US and the UK about emerging security threats.

Specifically, the study addressed those propagated by the “Vault 7” leaks, and the more massive global WannaCry and Petya ransomware attacks fueled by the “EternalBlue” Shadow Brokers leak.

Despite the majority being in agreement that cyberattacks are on the rise, most are confused about what threats pose the most risk as well as lacking the means to defend against them.

Less than half (45 percent) said they had the technology to prevent, detect and contain cybersecurity threats, while just 47 percent felt that they had enough budget.

While 69 percent of respondents had a high awareness of both WannaCry and Petya threats, they were far less aware of the potential of Vault 7 threats, with the highest level of awareness at 30 percent.

“The lack of knowledge among senior-level security executives is worrying—they know that attacks are on the increase, but many don’t know what they are and seem unable to effectively prevent them,” says Ponemon Institute founder Larry Ponemon.

“Better use needs to be made of the resources available, such as US CERT alerts, and the service providers that most businesses are using to outsource protection. Those providers also need to step up and provide education on where most attacks are coming from and how they can be prevented.”

Potentially even more worrying than the confusion over risk was the actual number of attacks that had been detected, with 54 percent admitting that their businesses had experienced an attack in the last year. Of those, 47 percent had been unable to prevent the attack.

The result of these successful cyberattacks included the theft of data assets (52 percent), the disruption to business process (47 percent), and IT downtime (41 percent).

Some of the other findings include:

  • 29 percent said that they would be unable to prevent a Petya attack and 28 percent would be unable to prevent a WannaCry attack
  • Businesses are even less prepared for Vault 7 exploit attacks, with only 9 percent ready to prevent exploits of Vault 7 threats like Dark Matter or After Midnight
  • 44% of respondents who were aware of the WannaCry patch didn’t implement it
  • 55% didn’t patch for Petya

“There is a role for managed service providers (MSPs) to play based on this research, by supporting companies as they navigate the ever-evolving security threats businesses face. It’s a bit like the wild west now, as we saw from the widespread fallout from WannaCry and Petya, and may still see from Vault 7 if those leaks are more widely exploited,” says SolarWinds MSP VP of security architecture Tim Brown.

“Indeed, we have no crystal ball to know what threats lie on the horizon. Businesses need help with everything from awareness to technology to specialized staff. This study supports a view that MSPs have a unique opportunity to expand their security offerings to meet this need by filling gaps that can’t be easily filled in house.”

Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.