Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/2/2017
02:08 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

It's About Time: Where Attackers Have the Upper Hand

Businesses take a median of 38 days to detect cybercrime, but can decrease the impact of a breach with faster incident response.

The median timeframe between attacker compromise and victim detection is 38 days. This "attacker dwell time" gives cybercriminals the advantage in security breaches, but businesses can mitigate the effects of a breach by up to 70% with faster incident response.

A new report titled "Cyber Security: For Defenders, It's About Time,, conducted by Aberdeen Group and commissioned by McAfee, digs into how time affects the business impact of cybercrime. Researchers analyzed data from the Verizon Data Breach Investigations Report (DBIR), which includes information on more than 1,300 breaches between 2014 and 2016.

Researchers found a broad range of incident response time among businesses. In half of the successful data breaches, it took five to six weeks or less for defenders to detect malicious activity. In the other half, detection took as long as four years.

"Half of [breaches] are dealt with in the first 38 days, which is actually pretty good," says Barbara Kay, senior director of product and solutions marketing at McAfee. "It could be better, but it's not too bad."

However, she continues, the four-year window in this data indicates there's a lot of activity in infrastructure that goes undetected for a long time. This is a sign of threat actors hidden deep within the business, which will take "deep hunting" to root out.

The longest timeframe will typically be with the most sophisticated type of attacker, Kay adds. Someone who is deep within the network for a long time either wants something (source code or blueprints, for example) or has a vendetta against the company.

"The sheer volume of modern-day vulnerabilities and exploits, paired with the increasingly sophisticated and targeted nature of cyberattacks, signifies the importance of time to detection for the modern enterprise," says Derek Brink, VP and research fellow at Aberdeen Group.

Organizations can mitigate the effects of security breaches by up to 70% with faster incident detection and response; however, the extent of this mitigation depends on the type of breach at hand. This research differentiates between two: business disruption and data breaches.

Attacks on business disruption target the availability of networks and network-based services. In Aberdeen's research, these do less damage upfront but continue to grow over time as hackers stay within the business and take their time to disrupt.

By doubling the speed of their incident response time, organizations can cut the impact of a disruptive cyberattack by 70%.

"The earlier you find an attack working on availability, the better off you're going to be," says Kay.

For data breaches, the business impact is greatest at the beginning of an exploit. There's a rapid falloff; the threat actors get in, cause damage quickly, and get out. Businesses can lessen the effects of a data breach by 30% by doubling the speed of their incident response time.

One of the challenges is, businesses can't keep up with vulnerability disclosures. Researchers found about 80% of the exploits for a given vulnerability are already in existence by the time it's publicized, but only 70% of vendor-provided patches, fixes, or workarounds are available.

Because patching requires time and resources, the report states, it could be weeks or months before businesses actually update their systems -- giving attackers a broad window of vulnerability.

"Cybersecurity practitioners looking to protect business value must move as quickly and nimbly as the adversaries they face, and regain the time currently working against them by implementing strategies that prioritize faster detection, investigation and response to incidents," says Brink.

Related Content

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...