Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/2/2017
02:08 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

It's About Time: Where Attackers Have the Upper Hand

Businesses take a median of 38 days to detect cybercrime, but can decrease the impact of a breach with faster incident response.

The median timeframe between attacker compromise and victim detection is 38 days. This "attacker dwell time" gives cybercriminals the advantage in security breaches, but businesses can mitigate the effects of a breach by up to 70% with faster incident response.

A new report titled "Cyber Security: For Defenders, It's About Time,, conducted by Aberdeen Group and commissioned by McAfee, digs into how time affects the business impact of cybercrime. Researchers analyzed data from the Verizon Data Breach Investigations Report (DBIR), which includes information on more than 1,300 breaches between 2014 and 2016.

Researchers found a broad range of incident response time among businesses. In half of the successful data breaches, it took five to six weeks or less for defenders to detect malicious activity. In the other half, detection took as long as four years.

"Half of [breaches] are dealt with in the first 38 days, which is actually pretty good," says Barbara Kay, senior director of product and solutions marketing at McAfee. "It could be better, but it's not too bad."

However, she continues, the four-year window in this data indicates there's a lot of activity in infrastructure that goes undetected for a long time. This is a sign of threat actors hidden deep within the business, which will take "deep hunting" to root out.

The longest timeframe will typically be with the most sophisticated type of attacker, Kay adds. Someone who is deep within the network for a long time either wants something (source code or blueprints, for example) or has a vendetta against the company.

"The sheer volume of modern-day vulnerabilities and exploits, paired with the increasingly sophisticated and targeted nature of cyberattacks, signifies the importance of time to detection for the modern enterprise," says Derek Brink, VP and research fellow at Aberdeen Group.

Organizations can mitigate the effects of security breaches by up to 70% with faster incident detection and response; however, the extent of this mitigation depends on the type of breach at hand. This research differentiates between two: business disruption and data breaches.

Attacks on business disruption target the availability of networks and network-based services. In Aberdeen's research, these do less damage upfront but continue to grow over time as hackers stay within the business and take their time to disrupt.

By doubling the speed of their incident response time, organizations can cut the impact of a disruptive cyberattack by 70%.

"The earlier you find an attack working on availability, the better off you're going to be," says Kay.

For data breaches, the business impact is greatest at the beginning of an exploit. There's a rapid falloff; the threat actors get in, cause damage quickly, and get out. Businesses can lessen the effects of a data breach by 30% by doubling the speed of their incident response time.

One of the challenges is, businesses can't keep up with vulnerability disclosures. Researchers found about 80% of the exploits for a given vulnerability are already in existence by the time it's publicized, but only 70% of vendor-provided patches, fixes, or workarounds are available.

Because patching requires time and resources, the report states, it could be weeks or months before businesses actually update their systems -- giving attackers a broad window of vulnerability.

"Cybersecurity practitioners looking to protect business value must move as quickly and nimbly as the adversaries they face, and regain the time currently working against them by implementing strategies that prioritize faster detection, investigation and response to incidents," says Brink.

Related Content

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30550
PUBLISHED: 2021-06-15
Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30551
PUBLISHED: 2021-06-15
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30552
PUBLISHED: 2021-06-15
Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-30553
PUBLISHED: 2021-06-15
Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-24037
PUBLISHED: 2021-06-15
A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untruste...