Attacks/Breaches

6/21/2016
10:00 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

7 Need-To-Know Attack Stats

Facts & figures about average dwell times, incident response speeds, and which direction the 'detection deficit' is heading.
Previous
1 of 7
Next


Image Source: Adobe Stock

Image Source: Adobe Stock

In information security and incident response, time is of the essence. The longer it takes to discover and remediate breaches, the more time attackers have to slowly bleed an organization of valuable information, set up persistence on the network, and otherwise wreak havoc without worry of repercussion.

Numerous security research and consultancies have established benchmarks for the average amount of time it takes to discover that attackers are operating within an infrastructure. The numbers vary from bad to worse. Take a look as Dark Reading explores some of the estimates, along with a few facts and figures about how costly long dwell times can be for organizations.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
alphaa10
50%
50%
alphaa10,
User Rank: Strategist
6/27/2016 | 11:35:57 PM
Wrong Direction
As if matters were not dire enough with an explosion in sophisticated, effective hacker tools, every criminal element which can capture a programmer or buy the software expects to rake in unprecedented profit.

Are corporate chiefs still asleep, trusting in the old IDS model for security? From all appearances, they are, indeed, and it will take millions more in losses before they awaken to the threat.

Poor training, coupled with antiquated threat indentification methods, understaffed IT sections, merger-speed corporate expansion, and profound ignorance of the threat conspire to make "corporate security" (almost) an oxymoron.

For Dark Readers, these are the dark ages of network security.

 

 
kbannan100
50%
50%
kbannan100,
User Rank: Apprentice
6/22/2016 | 10:49:33 AM
Re: The million dollar mark
"...the time from attack to compromise and attack to exfiltration is rarely longer than a few days."

Which means you have to be doubly vigilant when it comes to protecting everything -- endpoints such as printers and mobile devices, wireless connections, everything! And people are not doing that. Here's a portion of a white paper I have open on my desktop: 

"Many do not realize that embedded devices such as printers and industrial controllers can be the source or initial access point for a network breach. In fact, one of the largest identity theft cases in 2014 involved Target's POS systems and leveraged weaknesses within the building's HVAC systems to gain a foothold within Target's internal network." 

Crazy! The white paper can be found here, BTW: bit.ly/1sq1kyG

--Karen Bannan, commenting for IDG and HP
Charlie Babcock
100%
0%
Charlie Babcock,
User Rank: Ninja
6/21/2016 | 6:10:13 PM
The million dollar mark
Slide 4: Find a breach in its first 100 days, save a million dollars. Whew. What a statistic.
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
The Data Security Landscape Is Shifting: Is Your Company Prepared?
Francis Dinha, CEO & Co-Founder of OpenVPN,  8/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1712
PUBLISHED: 2018-08-16
IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters can trick the server into making potentially malicious calls within the trusted network. IBM X-Force ID: 146370.
CVE-2018-10139
PUBLISHED: 2018-08-16
The PAN-OS response page for GlobalProtect in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.
CVE-2018-10140
PUBLISHED: 2018-08-16
The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, resulting in all logged in users to be redirected to the login page. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected.
CVE-2018-11771
PUBLISHED: 2018-08-16
When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream,...
CVE-2018-1715
PUBLISHED: 2018-08-16
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 14700...