News
6/19/2014
03:00 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Bromium Research Reveals Insecurity in Existing Endpoint Protection Deployments

Survey of 300 information security practitioners highlights challenges securing end users

CUPERTINO, Calif. – June 18, 2014 – Bromium®, Inc., the pioneer of a new model of endpoint security using micro-virtualization, today announced the results of “Endpoint Protection: Attitudes and Opinions,” a survey of more than 300 information security practitioners focused on endpoint threats and security. The results of the survey indicate that the overwhelming majority of information security professionals believe their existing security solutions are unable to prevent all endpoint infections, anti-virus solutions are ineffective against advanced targeted attacks and end users are their biggest security concern.

“The reality today is that existing endpoint protection, such as AV, is ineffective because it is based on an old-fashioned model of detecting and fixing attacks after they occur,” said Rahul Kashyap, chief security architect, Bromium. “Sophisticated malware can easily evade detection to compromise endpoints, enabling cyber criminals to launch additional attacks that penetrate deeper into sensitive systems. Security professionals should explore a new paradigm of isolation-based protection to prevent these attacks.”

Key findings from “Endpoint Protection: Attitudes and Opinions” include:

  • Endpoints are vulnerable – Nearly 85 percent of respondents believe that their existing security technology is unable to prevent endpoint infections. Despite the proliferation of layered security solutions, attacks continue to exploit common vulnerabilities in operating systems, applications, browsers and plug-ins.
  • Anti-virus is ineffective – Nearly 85 percent of respondents believe that anti-virus solutions are unable to protect against advanced targeted attacks. Sophisticated malware is designed and tested to ensure it evades current security technologies, such as signature-based detection and behavioral analysis.
  • End users are a weak link – Nearly 75 percent of respondents believe that end users are responsible for their biggest security headaches. End users become infected by drive-by downloads, malicious URLs and email attachments, impacting productivity as security teams work to resolve compromise or restrict access.

“Despite the challenge in protecting end users, it is encouraging so many security professionals are aware of the shortcomings of existing technology,” continued Kashyap. “The recognition that the status quo is broken is the first step toward changing it for the better.”

Additional results from the survey found two-thirds (65 percent) of information security professionals are looking for endpoint protection that can stop both known and unknown threats. Further, three-quarters (75 percent) stated they would sleep better at night knowing a user could click on anything at any time without risk of infection.

Read the Bromium blog about “Endpoint Protection: Attitudes and Opinions” at http://blogs.bromium.com/2014/06/18/endpoint-protection-opinions

About Bromium, Inc.

Bromium is re-inventing enterprise security with its powerful new technology, micro-virtualization, which was designed to protect businesses from advanced malware, while simultaneously empowering users and delivering unmatched threat intelligence to IT. Unlike traditional security methods, which rely on complex and ineffective detection techniques, Bromium protects against malware from the Web, email or USB devices, by automatically isolating each user-task at the endpoint in a hardware-isolated micro-VM, preventing theft or damage to any enterprise resource. Bromium’s technological innovations have earned the company numerous industry awards including being named as a CNBC Disruptor and a Gartner Cool Vendor for 2013. Bromium counts a rapidly growing set of Fortune 500 companies and government agencies as customers, including NYSE and BlackRock.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0121
Published: 2015-05-30
IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation (RDNG) 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management (RM) session upon LTPA token ...

CVE-2015-0191
Published: 2015-05-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0191. Reason: This candidate is a duplicate of CVE-2014-0191. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0191 instead of this candidate. All references and descriptions in this candid...

CVE-2015-0193
Published: 2015-05-30
Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-0733
Published: 2015-05-30
CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID ...

CVE-2015-0743
Published: 2015-05-30
Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.

Dark Reading Radio
Archived Dark Reading Radio
After a serious cybersecurity incident, everyone will be looking to you for answers -- but you’ll never have complete information and you’ll never have enough time. So in those heated moments, when a business is on the brink of collapse, how will you and the rest of the board room executives respond?