Endpoint

4/29/2017
12:00 PM
Marc Wilczek
Marc Wilczek
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

10 Cybercrime Myths that Could Cost You Millions

Don't let a cybersecurity fantasy stop you from building the effective countermeasures you need to protect your organization from attack.

Cybercrime is all over the place, with damages, according to one estimate by Cybersecurity Ventures, expected to double from $3 trillion in 2015 to $6 trillion by 2021. In a prominent 2016 ransom attack, according to the 2016 McAfee Threat Report, a criminal was supposedly able to pocket $121 million within just six months, netting $94 million after expenses. Still, too often people believe in myths that prevent them from building effective countermeasures. Here are some examples:

Myth #1: Only large enterprises need to worry
No one is immune. Cybercrime is affecting everybody – people and businesses of all sizes alike. Radware concluded in their 2016-2017 Global Application & Network Security Report that 98% of organizations experienced cyberattacks in 2016. A reported 31% of these attacks were directed at small and mid-sized companies with less than 250 employees.

Myth #2: Threats are completely overrated; it’s not a big deal!
That’s wishful thinking; the frequency of incidents is eye-opening. According to McAfee Labs’ Threats Report, the average mid-sized organization (1,000–3,000 employees) encounters 11–20 incidents in a single day. Larger organizations (3,001–5,000 employees) are slightly busier, with the median at 21–30 incidents per day. The largest organizations (more than 5,000 employees) are busiest, with the median at 31–50 incidents daily.

Myth #3: Bad guys are always outsiders
According to the Radware report, roughly one-third (27%) of all incidents are caused by insiders due to malicious or accidental actions. Some sources believe that number to be much higher. Indeed, users are often unaware and easy to dupe. In a more recent Verizon study, 30% of phishing messages were opened by the target across all campaigns. Some 12% even went on to click the malicious attachment or link and thus enabled the attack to succeed.

Myth #4: Companies are prepared to combat cybercrime
New research this year from by BMC and Forbes (registration required) suggests that 68% plan to enhance incident response capabilities in the next 12 months. This seems to be overdue as companies are still pretty unprepared. The report notes that 40% have no incident response plans, while 70% have no cyber-insurance.

Myth #5: I’d sign up for an insurance policy if I could. I just wish life was that easy.
It’s a booming market. Perhaps one of the areas experiencing the strongest growth within the insurance area is cybersecurity. As a matter of fact, annual gross written premiums are set to triple– from around $2.5 billion in 2015 to $7.5 billion by 2020, according to PWC.

Myth #6: All of our PCs are equipped with antivirus and encryption – we’re fine!
Even so, bad news: by 2020, PCs will only play a minor role as the vast majority of users will opt for mobile devices such as tablets and smartphones instead. According to a 2015 prediction from Cisco, traffic from wireless and mobile devices will account for 66% of all IP traffic worldwide. Data stored on connected devices will be five times higher than data stored in data centers. Devices are used in highly insecure environments, including Wi-Fi hotspots, where intruders could potentially interfere. Moreover, according to a 2013 Ernst & Young whitepaper, millions of cell phones and smartphones are lost or stolen every year. Over their lifespan, approximately 22% of the total number of mobile devices produced will disappear, and over 50% of these will never be recovered.

Myth #7: We have great firewalls and network security, why bother?
Survey results from F5 Networks infer that network security is often not the issue; 57% struggle with the application layer instead. The frequency and severity of attacks on the application layer are considered much greater than at the network layer. Fifty-five percent say the application is attacked more often, with 58% thinking these attacks are more severe than at the network layer. Furthermore, there is a big mismatch in terms of budget allocation: on average, 18% of the IT security funding is dedicated to application security. More than twice that amount (39%) is pumped into network security.

Myth #8: Millennials are digital natives and more cautious
The common assumption that young talent, especially millennials, are digital natives and tech-savvy enough to safeguard corporate data is probably wrong. In fact, it’s likely going to be the opposite. Young people tend to be more relaxed and less concerned about privacy. They need even more awareness of today’s threats as they’re used to a completely different mindset where life is all about sharing – via social media and other channels that aren’t necessarily secure.

Myth #9: Strong passwords solve the issue
Strong passwords are powerful, but only when combined with other measures such as a two-factor authentication, for example. If strong passwords are too complicated to remember or users are forced to change them too frequently, people won’t be able to memorize them and will start making notes in one form or the other, thereby undermining even the most sophisticated security tools.

Myth #10: Let’s just hire a few more capable IT security gurus and we’ll be fine
Being understaffed remains the prime issue when it comes to countering cybercrime. Despite 47% of executives surveyed in 2017 by BMC and Forbes being willing to allocate more resources, the key question is how to find them. In a Trustwave 2016 report (registration required), 57% of respondents reported that finding and recruiting talented IT security staff is a “significant” or “major” challenge. Retaining these people is also viewed as a difficult problem by 35% of the respondents. There was a severe cybersecurity workforce gap, with 1 million vacancies in 2016, says Cyber Security Ventures. The shortage is expected to worsen and reach 1.5 million by 2019. Thus, hiring is a great idea, but much easier said than done.

[Check out the two-day Dark Reading Cybersecurity Crash Course at Interop ITX, May 15 & 16, where Dark Reading editors and some of the industry's top cybersecurity experts will share the latest data security trends and best practices.]

Related Content:

 

Marc Wilczek is an entrepreneur and senior executive with more than 20 years of leadership experience within the ICT space. He's passionate about all things #digital with emphasis on cloud, big data and IoT services. Before serving as VP portfolio, innovation & ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/4/2017 | 3:10:27 PM
Re: #4
@Marc: Gotcha.

23% of all respondents or 23% of those 40%?  Because you'd want to correlate that and know how that split works.
Marc Wilczek
50%
50%
Marc Wilczek,
User Rank: Author
5/3/2017 | 1:52:54 AM
Re: #4
@Joe: Just look at the stats of the Radware report: "mom-and-pop shops" don't represent 40% of the survey respondents. Only 23% of the respondents are from organizations with <100 employees.
faizmughal
50%
50%
faizmughal,
User Rank: Apprentice
5/2/2017 | 3:13:30 AM
Re: #4
nice
IDONTHAVEANICKNAME
50%
50%
IDONTHAVEANICKNAME,
User Rank: Apprentice
5/1/2017 | 1:21:13 PM
10 Cybercrime Myths that Could Cost You Millions
To which I could add an eleventh:

"I have'nt heard it from the BBC so it can't be an issue"

Yeah really....I did hear this from someone who shall remain nameless!

 

 

 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/1/2017 | 1:03:08 PM
Re: #4
@Marc: It's striking but I'm not sure how surprising it is, depending upon what the proportion of small, medium, and large businesses is and what the industry split is.  For a large healthcare or life-sciences organization to not have an incident-response plan is practically unheard of.  For a small mom-and-pop retailer to not have an incident response plan is not at all surprising (despite the wisdom of the decision).
Marc Wilczek
50%
50%
Marc Wilczek,
User Rank: Author
4/30/2017 | 1:43:26 AM
Re: #4
Your idea goes two steps further. What I find most striking about #4 is that "40% have no incident response plans" -- that's at least 'surprising' to put it mildly. Still far too many organizations are unprepared and hit by surprise, if an incident occurs.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
4/29/2017 | 6:31:06 PM
#4
Moreover, with all the debate about offensive cybersecurity -- i.e., "hacking back" -- as well as the legal uncertainties surrounding it, even some of the more security-conscious firms could feel stifled.
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Search Cybersecuruty and you will get unicorn.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.