Analytics

7/14/2016
10:00 AM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

72% of Black Hat Attendees Expect To Be Hit By 'Major' Data Breach Within A Year

End users are the biggest weakness, and we're not doing enough to address the problem.

Some of the most qualified security professionals around are more confident in attackers than they are in themselves or their end users.

A whopping 72% of respondents to the latest Black Hat Attendee Survey, released today, felt it was at least likely their organizations would have a major data breach in the next 12 months. Fifteen percent of the 250 respondents went so far as to say they had "no doubt," up from 13% last year. 

Two-thirds of respondents felt they didn't have enough staff, enough budget, or enough training to adequately address an ever-evolving threat landscape. The most common complaint? A shortage of qualified people and skills, which 37 percent of respondents listed among the top-three reasons that security initiatives fail -- soundly beating lack of management support (22%) and a lack of integration among security products (14%). Sixty-seven percent said they feel they themselves don't have the skills and training to do all the tasks they're responsible for.

This year, the Black Hat Attendee survey once again showed that security pros' time management and spending don't quite correspond with their top priorities. When asked how they spend most of their time, respondents listed measuring risk (35%), managing regulatory compliance (32%), and addressing vulnerabilities in internally developed applications (27%). However, when asked to list their top three concerns, respondents most often identified social engineering attacks (46%) and sophisticated, targeted attacks (43%).    

The worry about users being a weak link continued to arise. When asked "what is the weakest link in enterprise IT defenses" the number one answer by far was "End users who violate security policy and are too easily fooled by social engineering attacks," claiming 28%. (A lack of comprehensive security architecture and cloud services were distant second and third with 17% and 12%, respectively. Vulnerabilities in internally developed software -- one of the biggest time-gobblers -- was considered the weakest link by only 4%.)

With social engineering a burning worry, it's no surprise that when asked to identify the most serious new cyber threat to emerge in the past 12 months, respondents put two such issues at the top of the list. "A rapid increase in ransomware" took 37% and "social engineering attacks targeted directly at individuals in a specific organization" took 20%. 

When ticking that latter category, respondents likely had business email compromise attacks in mind. BECs have caused billions of dollars in losses and respondents indicate they aren't doing enough to combat the threat.   

Respondent Donald Codling, CISO of Urban FT, says his concern about BEC attacks is very high: "These attacks I think will go from being costly annoyances ... to forcing all manner of companies to reshape/retool their internal accounting and financial services departments ... basically go back to old school methods of two person authentication, regular visits or phone calls  to CFO/CEO to ask if these transactions are legit."

"We had a couple [BEC attacks] last year," says respondent Daniil Chernov, a global VP of application security. "But we [now] have a policy to double confirm the email content if it is asking for some serious steps to be performed."

Chernov says if he could change anything about his organization's security program he would "enhance staff awareness trainings," adding that "business is not happy to devote business hours for [these] procedures."

Chernov is not the only one who wants more awareness training. When asked what they would change about their security program if they could change anything, the most common answer to an open-ended question from a Dark Reading editor was more user awareness training.

Or, similarly, "Automate the entire business and flush out the humans," as respondent Jacob Anderson suggests. "Otherwise, just keep swimming." 

Despite all the challenges, the lion's share of security pros are whistling while they work. Only 11 percent of survey respondents said they were actively looking for new jobs and 32 percent (leaping up from 24 percent last year) said "I really love my job and my employer and it would take a LOT to get me to move."

"Every time I round up a phisher or spammer," says Anderson, "it makes my day."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

 

Related Black Hat 2016 Content:

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
100%
0%
JulietteRizkallah,
User Rank: Ninja
7/19/2016 | 3:01:12 PM
Data Breaches not a question of if but when
The 72% number is not surprising at all.  Honestly i would have expected 100% of response sbut the lower count may be attributed to interpretation of "major" data breaches.  When considering that 43% of data breaches in 2015 were caused by insiders - intentional or not - this number makes even more sense.  Unfortunately it will require IT staff more than catching a phisher or spammer to reduce the risk of breaches, from awareness and training of staff ( not just IT but mostly users) to implementing identity and data access management systems to govern the access to all structured and unstructured data.
Diversity: It's About Inclusion
Kelly Jackson Higgins, Executive Editor at Dark Reading,  4/25/2018
Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training
Sara Peters, Senior Editor at Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.