Attacks/Breaches
6/12/2014
08:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Report: Slow Detection, Slow Response

One-third of network security hacks are not discovered for hours, a report says.

More than one-third of data breaches aren't detected for hours, and recovering from a breach takes anywhere from days to months, a new survey says.

"The mean time to respond is the focus now," says Paul Nguyen, president of global security solutions for CSG Invotas, which sponsored the survey conducted by IDC. "We've seen a significant rise in the volume of incidents corporations have to deal with. This increasing tide has caused a gap between how much security operations can handle to be effective and how to bridge the gap and reduce response times."

The survey included security decision makers at firms with 500 or more employees. Some 61% say they are looking into ways to trim the time it takes to respond to a security event, and most say that trimming their response to a security breach or event helps protect the company's reputation and customer data.

One-fourth are in favor of automating some security processes, and they already use automation tools where possible, while 57% say they are "somewhat" comfortable automating some security processes, though with security teams involved, as well. Some 30% of security workflows are automated today, and two-thirds of companies say they will automate more elements in the next year.

The full survey is available for download here (registration required).

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
6/13/2014 | 3:50:47 PM
Re: Customer Relations
From a PR perspective, I hope that most companies are coming to the conclusion that they are better off getting out in front of the problem of a data breach, because it's going to come our eventually anyway. From a cybersecurity standpoint, I'm with @securityaffairs, when the effect of a data breach are discovered too late, the losses are often much greater. So a fast response is warranted on both counts.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
6/13/2014 | 2:58:18 PM
Re: Customer Relations
That's a really good point, @Whoopty. The sooner customers get word, the better for their privacy and financial security AND the rep of the breached company. Not all companies see it that way, though.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
6/13/2014 | 2:48:08 PM
Not surprised
The issue mentioned in the post is considered one of the greatest problems of the threat mitigation. Slow detection is the primary cause of losses ... in many cases the effects of a data breach or of a cyber attack are discovered too late, in other cases they will never be discovered.

It is necessary a layered approach to security to detect early the cyber threat.

 
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
6/13/2014 | 1:19:46 PM
Re: Customer Relations
@Whoopty

Amen to that, brother.  There's nothing more frustrating than working for a company that not only won't own up out of fear of losing credibility, or more important to them, customers, but to see the same thing happen again and again.  If they would only have come clean the first time, a solution might have come from other sources that actually works instead of trying to solve the problem on their own... 
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
6/13/2014 | 1:03:12 PM
Human vs Machine
I suspect there is a wide variety of conditions that lend to delayed response times from org to org.  For instance, I believe in a DevOps style security team, where you have security-oriented developers, hackers with experience on the systems doing real-time auditing and partial forensics on suspicious behavior, even if it isn't popping up on an alarm generated by the automated security suite; I also believe pushing the boundaries of your own network and apps but pen-testing.

However, I suspect there is a combination of lack of resources to pull off a team like this, and finding folks with the right set of expertise to bring it all together.  I'd be curious to see just how much longer delays in responding to intrusions are for companies with nothing but automated security software protecting them compared to real humans actively reviewing logs, watching/sniffing network traffic and auditing user activity.  I'm guessing leaving everything up to a collection of apps has the longer intrusion response time...
Whoopty
100%
0%
Whoopty,
User Rank: Ninja
6/13/2014 | 12:10:32 PM
Customer Relations
As much as I'd like to see security teams responding to issues in a more timely manner, whether it's automated or manual, I'm more interested in seeing better customer relations, with companies owning up when their security has been breached. 

Just as the company that's been hacked stands to lose data and resources from a hack, customers of that firm are also at risk, yet too often those that are breached either cover it up or wait a long time to let anyone know, meaning the problem is compounded.

Come clean about your security issues and everyone will feel far more accepting of them. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
6/13/2014 | 7:45:29 AM
Re: hours
I know, @Brian. The report didn't drill down into types of events, so finding malware was lumped into this question from what I understand. It's the more advanced attacks that are tougher to detect (the ones that AV does not sniff out), and these numbers were more inclusive of non-advanced events as well.

 
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/13/2014 | 12:32:15 AM
hours
I am surprised to even see this talked about in hours. I have seen reports talking about weeks and months. The Verizon report for example talked about something like 60 percent of breaches going undetected for months after an attack.

BP
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: nice one good
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas in a thought-provoking discussion about the evolving role of the CISO.