Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/20/2017
05:17 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Organizations Are Detecting Intrusions More Quickly

But almost every other metric in Trustwave's 2017 global cybersecurity report card is headed in the wrong direction.

More organizations appear to be heeding the advice to implement capabilities for detecting intrusions sooner, at least based on an analysis of data from breach investigations that security vendor Trustwave conducted for clients last year.

Trustwave's analysis showed that the median number of days from an intrusion to initial detection of the compromise fell sharply from 80.5 days in 2015 to 49 days in 2016. In other words, out of all organizations for which Trustwave conducted a breach investigation last year, half discovered the breach in 49 days or less, while half took longer.

The overall range was zero to 2,000 days, meaning at least one breached organization discovered the intrusion in less than one day, while at least one took more than five years.

The news was even better for internally detected data breaches. For organizations that detected an intrusion on their own, the median was 16 days, compared to 65 days for breaches that were externally detected. Once a breach was detected, the median duration of the time to containment was 153 days.

The numbers are welcome news in an industry where most statistics, especially those that are breach-related, tend only to go upwards most of the time.

"Security is starting to take a front seat to important buying decisions," says Brian Hussey, Trustwave's vice president of cyber threat detection and response. "Organizations are tired of being hit with costly clean-up following a security breach and recognize the immediate and long term value in always-on visibility and detection," he says.

Gartner recently reported the same trend. According to the analyst firm, detection and response technologies has become a top spending priority for organizations. Gartner expects it will remain that way through at least 2020 as organizations finally begin to shift away from prevention-only security strategies.

The trend does not mean that enterprises are abandoning prevention technologies completely. But it does send the message that "prevention is futile unless it is tied into a detection and response capability," Gartner analyst Sid Deshpande wrote.

Somewhat predictably though, the rest of the news in Trustwave's report was less encouraging. A stunning 99.7% of web applications that Trustwave's scanning services tested last year had at least one vulnerability. A majority had a lot more with the average detected being 11 vulnerabilities per application. The universe of vulnerable applications included banking apps, financial apps, games, productivity apps, and corporate applications.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

The most significant findings in Trustwave's report, says Hussey, related to the number of zero-day vulnerabilities exploited in the wild targeted at Adobe Flash Player, Microsoft Silverlight, and Internet Explorer.

"For opportunistic cybercriminals, vulnerabilities in code - particularly content management systems - represent an express lane to a reward destination," he says. Even a single exploitable vulnerability in a popular CMS can give attackers a way to steal user data or host exploits on potentially thousands of web servers, he says.

Application vulnerabilities were not the only bit of bad news in the Trustwave report. The company's analysis showed a massive 54% jump in spam email in 2016 compared to the year before. Spam emails accounted for as many as six in 10 of all inbound email. Thirty-five percent of spam email contained malware, an increase of 3% over 2015.

There were similar increases on other fronts as well. Incidents involving Point of Sale (POS) systems, particularly in North America, increased from 22% in 2015 to 31% last year. More than 50% of the attacks that Trustwave investigated targeted payment card data on POS systems.

Even so, corporate and internal business networks continued to be the most breached environments in 2016, accounting for more than 4 in 10 of all breaches that Trustwave investigated.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20934
PUBLISHED: 2020-11-28
An issue was discovered in the Linux kernel before 5.2.6. On NUMA systems, the Linux fair scheduler has a use-after-free in show_numa_stats() because NUMA fault statistics are inappropriately freed, aka CID-16d51a590a8c.
CVE-2020-29368
PUBLISHED: 2020-11-28
An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check, aka CID-c444eb564fb1.
CVE-2020-29369
PUBLISHED: 2020-11-28
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
CVE-2020-29370
PUBLISHED: 2020-11-28
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the required TID increment, aka CID-fd4d9c7d0c71.
CVE-2020-29371
PUBLISHED: 2020-11-28
An issue was discovered in romfs_dev_read in fs/romfs/storage.c in the Linux kernel before 5.8.4. Uninitialized memory leaks to userspace, aka CID-bcf85fcedfdd.