Analytics

7/14/2016
10:00 AM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

72% of Black Hat Attendees Expect To Be Hit By 'Major' Data Breach Within A Year

End users are the biggest weakness, and we're not doing enough to address the problem.

Some of the most qualified security professionals around are more confident in attackers than they are in themselves or their end users.

A whopping 72% of respondents to the latest Black Hat Attendee Survey, released today, felt it was at least likely their organizations would have a major data breach in the next 12 months. Fifteen percent of the 250 respondents went so far as to say they had "no doubt," up from 13% last year. 

Two-thirds of respondents felt they didn't have enough staff, enough budget, or enough training to adequately address an ever-evolving threat landscape. The most common complaint? A shortage of qualified people and skills, which 37 percent of respondents listed among the top-three reasons that security initiatives fail -- soundly beating lack of management support (22%) and a lack of integration among security products (14%). Sixty-seven percent said they feel they themselves don't have the skills and training to do all the tasks they're responsible for.

This year, the Black Hat Attendee survey once again showed that security pros' time management and spending don't quite correspond with their top priorities. When asked how they spend most of their time, respondents listed measuring risk (35%), managing regulatory compliance (32%), and addressing vulnerabilities in internally developed applications (27%). However, when asked to list their top three concerns, respondents most often identified social engineering attacks (46%) and sophisticated, targeted attacks (43%).    

The worry about users being a weak link continued to arise. When asked "what is the weakest link in enterprise IT defenses" the number one answer by far was "End users who violate security policy and are too easily fooled by social engineering attacks," claiming 28%. (A lack of comprehensive security architecture and cloud services were distant second and third with 17% and 12%, respectively. Vulnerabilities in internally developed software -- one of the biggest time-gobblers -- was considered the weakest link by only 4%.)

With social engineering a burning worry, it's no surprise that when asked to identify the most serious new cyber threat to emerge in the past 12 months, respondents put two such issues at the top of the list. "A rapid increase in ransomware" took 37% and "social engineering attacks targeted directly at individuals in a specific organization" took 20%. 

When ticking that latter category, respondents likely had business email compromise attacks in mind. BECs have caused billions of dollars in losses and respondents indicate they aren't doing enough to combat the threat.   

Respondent Donald Codling, CISO of Urban FT, says his concern about BEC attacks is very high: "These attacks I think will go from being costly annoyances ... to forcing all manner of companies to reshape/retool their internal accounting and financial services departments ... basically go back to old school methods of two person authentication, regular visits or phone calls  to CFO/CEO to ask if these transactions are legit."

"We had a couple [BEC attacks] last year," says respondent Daniil Chernov, a global VP of application security. "But we [now] have a policy to double confirm the email content if it is asking for some serious steps to be performed."

Chernov says if he could change anything about his organization's security program he would "enhance staff awareness trainings," adding that "business is not happy to devote business hours for [these] procedures."

Chernov is not the only one who wants more awareness training. When asked what they would change about their security program if they could change anything, the most common answer to an open-ended question from a Dark Reading editor was more user awareness training.

Or, similarly, "Automate the entire business and flush out the humans," as respondent Jacob Anderson suggests. "Otherwise, just keep swimming." 

Despite all the challenges, the lion's share of security pros are whistling while they work. Only 11 percent of survey respondents said they were actively looking for new jobs and 32 percent (leaping up from 24 percent last year) said "I really love my job and my employer and it would take a LOT to get me to move."

"Every time I round up a phisher or spammer," says Anderson, "it makes my day."

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

 

Related Black Hat 2016 Content:

 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
JulietteRizkallah
100%
0%
JulietteRizkallah,
User Rank: Ninja
7/19/2016 | 3:01:12 PM
Data Breaches not a question of if but when
The 72% number is not surprising at all.  Honestly i would have expected 100% of response sbut the lower count may be attributed to interpretation of "major" data breaches.  When considering that 43% of data breaches in 2015 were caused by insiders - intentional or not - this number makes even more sense.  Unfortunately it will require IT staff more than catching a phisher or spammer to reduce the risk of breaches, from awareness and training of staff ( not just IT but mostly users) to implementing identity and data access management systems to govern the access to all structured and unstructured data.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
2019 Attacker Playbook
Ericka Chickowski, Contributing Writer, Dark Reading,  12/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
[Sponsored Content] The State of Encryption and How to Improve It
[Sponsored Content] The State of Encryption and How to Improve It
Encryption and access controls are considered to be the ultimate safeguards to ensure the security and confidentiality of data, which is why they're mandated in so many compliance and regulatory standards. While the cybersecurity market boasts a wide variety of encryption technologies, many data breaches reveal that sensitive and personal data has often been left unencrypted and, therefore, vulnerable.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-15031
PUBLISHED: 2018-12-18
In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information.
CVE-2018-19522
PUBLISHED: 2018-12-18
DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL (0x800020F4) with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input.
CVE-2018-1833
PUBLISHED: 2018-12-18
IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit this vulnerability to spoof the request header. IBM X-Force ID: 150507.
CVE-2018-4015
PUBLISHED: 2018-12-18
An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server to...
CVE-2018-20201
PUBLISHED: 2018-12-18
There is a stack-based buffer over-read in the jsfNameFromString function of jsflash.c in Espruino 2V00, leading to a denial of service or possibly unspecified other impact via a crafted js file.