Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

7/14/2016
10:00 AM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

72% of Black Hat Attendees Expect To Be Hit By 'Major' Data Breach Within A Year

End users are the biggest weakness, and we're not doing enough to address the problem.

Some of the most qualified security professionals around are more confident in attackers than they are in themselves or their end users.

A whopping 72% of respondents to the latest Black Hat Attendee Survey, released today, felt it was at least likely their organizations would have a major data breach in the next 12 months. Fifteen percent of the 250 respondents went so far as to say they had "no doubt," up from 13% last year. 

Two-thirds of respondents felt they didn't have enough staff, enough budget, or enough training to adequately address an ever-evolving threat landscape. The most common complaint? A shortage of qualified people and skills, which 37 percent of respondents listed among the top-three reasons that security initiatives fail -- soundly beating lack of management support (22%) and a lack of integration among security products (14%). Sixty-seven percent said they feel they themselves don't have the skills and training to do all the tasks they're responsible for.

This year, the Black Hat Attendee survey once again showed that security pros' time management and spending don't quite correspond with their top priorities. When asked how they spend most of their time, respondents listed measuring risk (35%), managing regulatory compliance (32%), and addressing vulnerabilities in internally developed applications (27%). However, when asked to list their top three concerns, respondents most often identified social engineering attacks (46%) and sophisticated, targeted attacks (43%).    

The worry about users being a weak link continued to arise. When asked "what is the weakest link in enterprise IT defenses" the number one answer by far was "End users who violate security policy and are too easily fooled by social engineering attacks," claiming 28%. (A lack of comprehensive security architecture and cloud services were distant second and third with 17% and 12%, respectively. Vulnerabilities in internally developed software -- one of the biggest time-gobblers -- was considered the weakest link by only 4%.)

With social engineering a burning worry, it's no surprise that when asked to identify the most serious new cyber threat to emerge in the past 12 months, respondents put two such issues at the top of the list. "A rapid increase in ransomware" took 37% and "social engineering attacks targeted directly at individuals in a specific organization" took 20%. 

When ticking that latter category, respondents likely had business email compromise attacks in mind. BECs have caused billions of dollars in losses and respondents indicate they aren't doing enough to combat the threat.   

Respondent Donald Codling, CISO of Urban FT, says his concern about BEC attacks is very high: "These attacks I think will go from being costly annoyances ... to forcing all manner of companies to reshape/retool their internal accounting and financial services departments ... basically go back to old school methods of two person authentication, regular visits or phone calls  to CFO/CEO to ask if these transactions are legit."

"We had a couple [BEC attacks] last year," says respondent Daniil Chernov, a global VP of application security. "But we [now] have a policy to double confirm the email content if it is asking for some serious steps to be performed."

Chernov says if he could change anything about his organization's security program he would "enhance staff awareness trainings," adding that "business is not happy to devote business hours for [these] procedures."

Chernov is not the only one who wants more awareness training. When asked what they would change about their security program if they could change anything, the most common answer to an open-ended question from a Dark Reading editor was more user awareness training.

Or, similarly, "Automate the entire business and flush out the humans," as respondent Jacob Anderson suggests. "Otherwise, just keep swimming." 

Despite all the challenges, the lion's share of security pros are whistling while they work. Only 11 percent of survey respondents said they were actively looking for new jobs and 32 percent (leaping up from 24 percent last year) said "I really love my job and my employer and it would take a LOT to get me to move."

"Every time I round up a phisher or spammer," says Anderson, "it makes my day."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

 

Related Black Hat 2016 Content:

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
100%
0%
JulietteRizkallah,
User Rank: Ninja
7/19/2016 | 3:01:12 PM
Data Breaches not a question of if but when
The 72% number is not surprising at all.  Honestly i would have expected 100% of response sbut the lower count may be attributed to interpretation of "major" data breaches.  When considering that 43% of data breaches in 2015 were caused by insiders - intentional or not - this number makes even more sense.  Unfortunately it will require IT staff more than catching a phisher or spammer to reduce the risk of breaches, from awareness and training of staff ( not just IT but mostly users) to implementing identity and data access management systems to govern the access to all structured and unstructured data.
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.