Attacks/Breaches

11/7/2013
07:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Survey Exposes The Dirty Little Secret Of Undisclosed Breaches

Nearly 70 percent of U.S. security pros say complexity and volume of malware attacks hinder their defenses

Nearly 60 percent of malware investigations in U.S. enterprises involve data breaches that were not disclosed, according to new research.

Some 66 percent of security professionals at U.S. companies with more than 500 employees say they have investigated or worked on a breach that was not disclosed by their organizations, while 57 percent said they had worked on a data breach that went unreported, according to a survey of 200 security professionals by OpinionMatters, which was commissioned by ThreatTrack.

"While it is discouraging that so many malware analysts are aware of data breaches that enterprises have not disclosed, it is no surprise that the breaches are occurring," says Julian Waits, CEO at ThreatTrack. "Every day, malware becomes more sophisticated, and U.S. enterprises are constantly targeted for cyberespionage campaigns from overseas competitors and foreign governments. This study reveals that malware analysts are acutely aware of the threats they face, and while many of them report progress in their ability to combat cyberattacks, they also point out deficiencies in resources and tools."

Senior executives' devices become infected 56 percent of the time due to their opening a malicious URL in a phishing email, 45 percent of the time after letting a family member use a company-owned device, 40 percent of the time due to visiting a pornographic website, and 33 percent for installing a malicious mobile app.

Around 40 percent of the IT pros say one of their biggest challenges is they don't have the security staff resources they need. Some 67 percent say malware complexity is the hardest part of protecting their networks; 67 percent, the volume of malware attacks; and 58 percent, ineffective anti-malware products.

It takes more than two hours for more than half of security pros to analyze a new malware sample, and 4 percent say it takes them less than an hour.

A white paper on the report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
11/14/2013 | 7:59:52 AM
re: Survey Exposes The Dirty Little Secret Of Undisclosed Breaches
In order to think strategically about the investments in security, itGs important to define
and measure the risks. In our recent survey on application security maturity, we found that the use of a threat model or other high-level risk assessment is exhibited by only 43% of surveyed organizations. This lack of measurement makes it very difficult to invest effectively or to improve over time the state of security application.

To better understand this, I recommend checking out the key findings from the research in this series of articles on our blog: http://blog.securityinnovation...

Hope you find it useful!
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.