Attacks/Breaches

6/21/2016
10:00 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

7 Need-To-Know Attack Stats

Facts & figures about average dwell times, incident response speeds, and which direction the 'detection deficit' is heading.
Previous
1 of 7
Next


Image Source: Adobe Stock

Image Source: Adobe Stock

In information security and incident response, time is of the essence. The longer it takes to discover and remediate breaches, the more time attackers have to slowly bleed an organization of valuable information, set up persistence on the network, and otherwise wreak havoc without worry of repercussion.

Numerous security research and consultancies have established benchmarks for the average amount of time it takes to discover that attackers are operating within an infrastructure. The numbers vary from bad to worse. Take a look as Dark Reading explores some of the estimates, along with a few facts and figures about how costly long dwell times can be for organizations.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
alphaa10
50%
50%
alphaa10,
User Rank: Strategist
6/27/2016 | 11:35:57 PM
Wrong Direction
As if matters were not dire enough with an explosion in sophisticated, effective hacker tools, every criminal element which can capture a programmer or buy the software expects to rake in unprecedented profit.

Are corporate chiefs still asleep, trusting in the old IDS model for security? From all appearances, they are, indeed, and it will take millions more in losses before they awaken to the threat.

Poor training, coupled with antiquated threat indentification methods, understaffed IT sections, merger-speed corporate expansion, and profound ignorance of the threat conspire to make "corporate security" (almost) an oxymoron.

For Dark Readers, these are the dark ages of network security.

 

 
kbannan100
50%
50%
kbannan100,
User Rank: Apprentice
6/22/2016 | 10:49:33 AM
Re: The million dollar mark
"...the time from attack to compromise and attack to exfiltration is rarely longer than a few days."

Which means you have to be doubly vigilant when it comes to protecting everything -- endpoints such as printers and mobile devices, wireless connections, everything! And people are not doing that. Here's a portion of a white paper I have open on my desktop: 

"Many do not realize that embedded devices such as printers and industrial controllers can be the source or initial access point for a network breach. In fact, one of the largest identity theft cases in 2014 involved Target's POS systems and leveraged weaknesses within the building's HVAC systems to gain a foothold within Target's internal network." 

Crazy! The white paper can be found here, BTW: bit.ly/1sq1kyG

--Karen Bannan, commenting for IDG and HP
Charlie Babcock
100%
0%
Charlie Babcock,
User Rank: Ninja
6/21/2016 | 6:10:13 PM
The million dollar mark
Slide 4: Find a breach in its first 100 days, save a million dollars. Whew. What a statistic.
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3018
PUBLISHED: 2018-05-24
The AXIS webapp in deploy-tomcat/axis in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 allows remote attackers to obtain sensitive configuration information via a direct request, as demonstrated by happyaxis.jsp. IBM X-Force ID: 84354.
CVE-2013-3023
PUBLISHED: 2018-05-24
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 and 7.2.0 through 7.2.1.4 might allow remote attackers to obtain sensitive information about Tomcat credentials by sniffing the network for a session in which HTTP is used. IBM X-Force ID: 84361.
CVE-2013-3024
PUBLISHED: 2018-05-24
IBM WebSphere Application Server (WAS) 8.5 through 8.5.0.2 on UNIX allows local users to gain privileges by leveraging improper process initialization. IBM X-Force ID: 84362.
CVE-2018-5674
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...
CVE-2018-5675
PUBLISHED: 2018-05-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader before 9.1 and PhantomPDF before 9.1. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...