Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

7/14/2016
10:00 AM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

72% of Black Hat Attendees Expect To Be Hit By 'Major' Data Breach Within A Year

End users are the biggest weakness, and we're not doing enough to address the problem.

Some of the most qualified security professionals around are more confident in attackers than they are in themselves or their end users.

A whopping 72% of respondents to the latest Black Hat Attendee Survey, released today, felt it was at least likely their organizations would have a major data breach in the next 12 months. Fifteen percent of the 250 respondents went so far as to say they had "no doubt," up from 13% last year. 

Two-thirds of respondents felt they didn't have enough staff, enough budget, or enough training to adequately address an ever-evolving threat landscape. The most common complaint? A shortage of qualified people and skills, which 37 percent of respondents listed among the top-three reasons that security initiatives fail -- soundly beating lack of management support (22%) and a lack of integration among security products (14%). Sixty-seven percent said they feel they themselves don't have the skills and training to do all the tasks they're responsible for.

This year, the Black Hat Attendee survey once again showed that security pros' time management and spending don't quite correspond with their top priorities. When asked how they spend most of their time, respondents listed measuring risk (35%), managing regulatory compliance (32%), and addressing vulnerabilities in internally developed applications (27%). However, when asked to list their top three concerns, respondents most often identified social engineering attacks (46%) and sophisticated, targeted attacks (43%).    

The worry about users being a weak link continued to arise. When asked "what is the weakest link in enterprise IT defenses" the number one answer by far was "End users who violate security policy and are too easily fooled by social engineering attacks," claiming 28%. (A lack of comprehensive security architecture and cloud services were distant second and third with 17% and 12%, respectively. Vulnerabilities in internally developed software -- one of the biggest time-gobblers -- was considered the weakest link by only 4%.)

With social engineering a burning worry, it's no surprise that when asked to identify the most serious new cyber threat to emerge in the past 12 months, respondents put two such issues at the top of the list. "A rapid increase in ransomware" took 37% and "social engineering attacks targeted directly at individuals in a specific organization" took 20%. 

When ticking that latter category, respondents likely had business email compromise attacks in mind. BECs have caused billions of dollars in losses and respondents indicate they aren't doing enough to combat the threat.   

Respondent Donald Codling, CISO of Urban FT, says his concern about BEC attacks is very high: "These attacks I think will go from being costly annoyances ... to forcing all manner of companies to reshape/retool their internal accounting and financial services departments ... basically go back to old school methods of two person authentication, regular visits or phone calls  to CFO/CEO to ask if these transactions are legit."

"We had a couple [BEC attacks] last year," says respondent Daniil Chernov, a global VP of application security. "But we [now] have a policy to double confirm the email content if it is asking for some serious steps to be performed."

Chernov says if he could change anything about his organization's security program he would "enhance staff awareness trainings," adding that "business is not happy to devote business hours for [these] procedures."

Chernov is not the only one who wants more awareness training. When asked what they would change about their security program if they could change anything, the most common answer to an open-ended question from a Dark Reading editor was more user awareness training.

Or, similarly, "Automate the entire business and flush out the humans," as respondent Jacob Anderson suggests. "Otherwise, just keep swimming." 

Despite all the challenges, the lion's share of security pros are whistling while they work. Only 11 percent of survey respondents said they were actively looking for new jobs and 32 percent (leaping up from 24 percent last year) said "I really love my job and my employer and it would take a LOT to get me to move."

"Every time I round up a phisher or spammer," says Anderson, "it makes my day."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

 

Related Black Hat 2016 Content:

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
100%
0%
JulietteRizkallah,
User Rank: Ninja
7/19/2016 | 3:01:12 PM
Data Breaches not a question of if but when
The 72% number is not surprising at all.  Honestly i would have expected 100% of response sbut the lower count may be attributed to interpretation of "major" data breaches.  When considering that 43% of data breaches in 2015 were caused by insiders - intentional or not - this number makes even more sense.  Unfortunately it will require IT staff more than catching a phisher or spammer to reduce the risk of breaches, from awareness and training of staff ( not just IT but mostly users) to implementing identity and data access management systems to govern the access to all structured and unstructured data.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
CVE-2020-13646
PUBLISHED: 2020-06-05
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL.