Although financial services organisation are well aware that they are the targets of serious and advanced security threats, they struggle to identify attacks once they are inside their network.
This is according to a new Ponemon Institute Survey, sponsored by Arbor Networks, which finds that the “dwell” time – the average time it takes to identify these attacks – is 98 days for financial services organisations.
Despite these results, 58% of financial services organisations said they are not optimistic about their ability to improve these findings in the coming year. This is alarming considering the number of attacks targeting their networks – 83% experienced more than 50 attacks per month.
“The big takeaway from our research is that more investment is needed in both security operations staff and in security tools, which can help companies efficiently and accurately detect and respond to security incidents,” says Dr Larry Ponemon, chairman and founder of the Ponemon Institute. “The time to detect an advanced threat is far too long; attackers are getting in and staying long enough that the damage caused is often irreparable.”
Bryan Hamman, territory manager for sub-Saharan Africa at Arbor Networks, adds: “It’s time to find a better balance between technology solutions, usability, workflow and the people who use them. As security vendors, we need to help our customers so they can adapt to this new cyber-security reality that balances the threats with the people who fight them every day.”
In the wake of high profile mega breaches, the Ponemon Institute, surveyed financial services organisations in North America and Europe, Middle East and Africa (EMEA) to better understand how they are dealing with attacks targeting their organisations.
The survey asked how organisations manage the explosion in advanced threats and distributed denial of service (DDoS) attacks targeting their infrastructure; how effective (or not) their IT investments are; and how they are adapting incident response procedures and integrating threat intelligence for better visibility, insight and context.
Key findings among the financial services organisation surveyed are:
* Advanced threats – 71% view technologies that provide intelligence about networks and traffic as most promising at stopping or minimising advance threats during the seven phases of the Kill Chain; 45% have implemented incident response procedures; and 43% percent have established threat sharing with other companies or government entities.
* DDoS attacks – 55% consider DDoS attacks as an advanced threat; 48% “Strongly Agree” or “Agree” that they are effective in containing DDoS attacks; and 45% have established threat sharing with other companies or government entities to minimise or contain the impact of DDoS attacks.
* Budgets and staffing – 40% of budgets are allocated towards technology; 37% to staffing and 20% to managed services.
The financial services organisations surveyed included 844 IT and IT security practitioners in North America and in 14 countries in Europe, Middle East & Africa (EMEA) – only IT practitioners who are familiar with their companies’ defence against cyber-security attacks and have responsibility for directing cyber-security activities within the company were selected to take part.
Arbor Networks’ security products are exclusively distributed by Networks Unlimited in South Africa and sub-Saharan Africa.