Threat Intelligence
7/12/2017
10:45 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Faster Cyberattack Detection Can Limit Business Impact by 70%: Cyber adAPT, Aberdeen Group

July 11, 2017 – Half Moon Bay, California – A new report released today, commissioned by Cyber adAPT and conducted by Aberdeen Group, has revealed that cyber attack detection and response times have a critical status in protecting access to infrastructure and data within modern networks.

New insight detailed in the report entitled ‘The need for speed: faster detection requires a new type of platform’, reveals that doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.

The report also shows that improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.

Monte Carlo analysis: Reducing the Business Impact of Disruptions and Data Breaches

Source: Monte Carlo analysis; Aberdeen Group June 2017

The findings help contextualize the current cyber security climate, which McKinsey and the World Economic Forum has previously described as one where 60% of technology executives agree the sophistication as well as the pace of attacks will increase faster than the ability of institutions to defend themselves[i].

The report also consolidates existing research from Aberdeen Group, which found:

  • Two out of five (39%) organizations are moving from a traditional, PC-oriented computing environment toward an increasingly mobile-first infrastructure, and half (49%) of all respondents have already invested in connected devices (IoT) initiatives[ii].
  • In a study of 3,000 current network firewall installations nearly half (46%) of all organizations were dealing with multiple sites and/or multiple firewall vendors[iii].
  • In an analysis of nearly 11,000 security monitoring and analytics installations, two-thirds of CISOs are taking a tools-based approach to cyber security, installing a single product at a single site. The remaining third of installations typified a platform approach[iv].
  • In current technology installations of virtualization and cloud computing initiatives involving 336 products from 57 vendors, there were more than 1.6 billion permutations in the simple six-layer stack[v].

The report describes a dynamic infrastructure, which includes a mix of traditional servers, private clouds, and public clouds as “the new normal”, and notes that its complexity means that using prevention-led methods cannot be successful 100% of the time.

Kirsten Bay, President and CEO of Cyber adAPT commented on the new insights and wider report: “Criminals are gaining access to our networks regardless of how much money has been sent on perimeter defenses. The unique, new insights released today demonstrate the pressing need for CISOs to be able to quickly detect these inevitable breaches and act upon them immediately, if they are to limit the impact.[vi]

Bay continues:

“Furthermore, the report identifies that today’s enterprise computing infrastructure is increasingly digital, edgeless and hybrid. With a vast number of firewall installations and other security tools to manage, the data demonstrates that a strategy focused on prevention alone is no longer enough – detecting anomalies and defending this blurred perimeter is simply beyond human capability.”

Derek Brink, Vice President and Research Fellow, Aberdeen Group and author of the report commented: “Our report shows that in securing increasingly complex computing infrastructures CISOs have a bastion of tools at their disposal. But this has only served to deliver an onslaught of alerts, which take time to filter. To regain their time advantage against attackers, CISOs need a single platform, which integrates data from multiple sources and offers optimized visibility into a rapidly changing threat landscape. This will allow them to detect threats in real-time and respond before attackers compromise information and remove access to vital infrastructure.”

Key insights:

  • When it comes to detection, response and recovery time are crucial.
  • CISOs need to make the business case for how faster detection, effective response, and rapid recovery reduces the impact of attacks.
  • Doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.
  • Improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.
  • Today’s enterprise computing infrastructure is a dynamic blend of traditional networks, expanding user bases, a mix of private and public clouds, and connected devices.
  • In such an environment, timely detection of active attacks – at the scale and speed needed – requires a new type of platform.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
A Call for Greater Regulation of Digital Currencies
Kelly Sheridan, Associate Editor, Dark Reading,  11/21/2017
New OWASP Top 10 List Includes Three New Web Vulns
Jai Vijayan, Freelance writer,  11/21/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.