IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up to date technology.
This is according to the Sophos survey “The Impossible Puzzle of Cybersecurity”, that polled 3 100 IT decision makers from mid-sized businesses in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.
The Sophos survey shows how attack techniques are varied and often multi-staged, increasing the difficulty to defend networks. One in five IT managers surveyed didn’t know how they were breached, and the diversity of attack methods means no one defensive strategy is a silver bullet.
“Cybercriminals are evolving their attack methods and often use multiple payloads to maximize profits. Software exploits were the initial point of entry in 23 percent of incidents, but they were also used in some fashion in 35% of all attacks, demonstrating how exploits are used at multiple stages of the attack chain,” says Chester Wisniewski, principal research scientist atSophos. “Organizations that are only patching externally facing high-risk servers are left vulnerable internally and cybercriminals are taking advantage of this and other security lapses.”
The wide range, multiple stages and scale of today’s attacks are proving effective. For example, 53% of those who fell victim to a cyberattack were hit by a phishing email, and 30 percent by ransomware. Forty-one percent said they suffered a data breach.
In South Africa, cybercriminal tactics have evolved into using multiple attack methods and often multiple payloads to maximize profits:
* Software exploits were the initial cause of 17% of incidents and used in 23% of cyberattacks, demonstrating how exploits are used at multiple stages of the attack chain;
* Phishing emails impacted 47% of those hit by a cyberattack;
* Ransomware impacted 38% of attack victims; and
* 39% of attack victims suffered a data breach.
Based on the responses, it’s not surprising that 75% of IT managers consider software exploits, unpatched vulnerabilities and/or zero-day threats as a top security risk. Fifty percent consider phishing a top security risk. Alarmingly, only 16% of IT managers consider supply chain a top security risk, exposing an additional weak spot that cybercriminals will likely add to their repertoire of attack vectors.
“Cybercriminals are always looking for a way into an organisation, and supply chain attacks are ranking higher now on their list of methods. IT managers should prioritize supply chain as a security risk, but don’t because they consider these attacks perpetrated by nation states on high profile targets. While it is true that nation states may have created the blueprints for these attacks, once these techniques are publicized, other cybercriminals often adopt them for their ingenuity and high success rate,” says Wisniewski.
“Supply chain attacks are also an effective way for cybercriminals to carry out automated, active attacks, where they select a victim from a larger pool of prospects and then actively hack into that specific organization using hand-to-keyboard techniques and lateral movements to evade detection and reach their destination.”
Just 16% of South Africa respondents consider supply chain a top security risk, exposing a potential weak spot.
However, nation state adversaries have proven how successful supply chain attacks are, which means common cybercriminals are likely to adopt the attack method; and supply chain attacks are a launch pad to emerging automated, active-adversary attacks.
According to the Sophos survey, IT managers reported that 26% of their team’s time is spent managing security, on average. Yet, 86 percent agree security expertise could be improved and 80% want a stronger team in place to detect, investigate and respond to security incidents. Recruiting talent is also an issue, with 79% saying that recruiting people with the cybersecurity skills they need is challenge.
Regarding budget, 66% said their organisation’s cybersecurity budget (including people and technology) is below what it needs to be. Having current technology in place is another problem, with 75% agreeing that staying up to date with cybersecurity technology is a challenge for their organization. This lack of security expertise, budget and up to date technology indicates IT managers are struggling to respond to cyberattacks instead of proactively planning and handling what’s coming next.
South African IT teams spend 27% of their time managing security, yet still struggle with a lack of expertise, budget and up to date technology.
A massive 74% said recruiting people with the cybersecurity skills they need is challenge.
Mwanwhile, 65% said their organisation’s cybersecurity budget is below what it needs to be; and 73% believe that staying up to date with cybersecurity technology is a challenge.
“Staying on top of where threats are coming from takes dedicated expertise, but IT managers often have a hard time finding the right talent or don’t have a proper security system in place that allows them to respond quickly and efficiently to attacks,” says Wisniewski. “If organisations can adopt a security system with products that work together to share intelligence and automatically react to threats, then IT security teams can avoid the trap of perpetually catching up after yesterday’s attack and better defend against what’s going to happen tomorrow.
“Having a security ‘system’ in place helps alleviate the security skills gap IT managers are facing. It’s much more time and cost effective for businesses to grow their security maturity with simple to use tools that coordinate with each other across an entire estate.”