Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/20/2017
05:17 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Organizations Are Detecting Intrusions More Quickly

But almost every other metric in Trustwave's 2017 global cybersecurity report card is headed in the wrong direction.

More organizations appear to be heeding the advice to implement capabilities for detecting intrusions sooner, at least based on an analysis of data from breach investigations that security vendor Trustwave conducted for clients last year.

Trustwave's analysis showed that the median number of days from an intrusion to initial detection of the compromise fell sharply from 80.5 days in 2015 to 49 days in 2016. In other words, out of all organizations for which Trustwave conducted a breach investigation last year, half discovered the breach in 49 days or less, while half took longer.

The overall range was zero to 2,000 days, meaning at least one breached organization discovered the intrusion in less than one day, while at least one took more than five years.

The news was even better for internally detected data breaches. For organizations that detected an intrusion on their own, the median was 16 days, compared to 65 days for breaches that were externally detected. Once a breach was detected, the median duration of the time to containment was 153 days.

The numbers are welcome news in an industry where most statistics, especially those that are breach-related, tend only to go upwards most of the time.

"Security is starting to take a front seat to important buying decisions," says Brian Hussey, Trustwave's vice president of cyber threat detection and response. "Organizations are tired of being hit with costly clean-up following a security breach and recognize the immediate and long term value in always-on visibility and detection," he says.

Gartner recently reported the same trend. According to the analyst firm, detection and response technologies has become a top spending priority for organizations. Gartner expects it will remain that way through at least 2020 as organizations finally begin to shift away from prevention-only security strategies.

The trend does not mean that enterprises are abandoning prevention technologies completely. But it does send the message that "prevention is futile unless it is tied into a detection and response capability," Gartner analyst Sid Deshpande wrote.

Somewhat predictably though, the rest of the news in Trustwave's report was less encouraging. A stunning 99.7% of web applications that Trustwave's scanning services tested last year had at least one vulnerability. A majority had a lot more with the average detected being 11 vulnerabilities per application. The universe of vulnerable applications included banking apps, financial apps, games, productivity apps, and corporate applications.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

The most significant findings in Trustwave's report, says Hussey, related to the number of zero-day vulnerabilities exploited in the wild targeted at Adobe Flash Player, Microsoft Silverlight, and Internet Explorer.

"For opportunistic cybercriminals, vulnerabilities in code - particularly content management systems - represent an express lane to a reward destination," he says. Even a single exploitable vulnerability in a popular CMS can give attackers a way to steal user data or host exploits on potentially thousands of web servers, he says.

Application vulnerabilities were not the only bit of bad news in the Trustwave report. The company's analysis showed a massive 54% jump in spam email in 2016 compared to the year before. Spam emails accounted for as many as six in 10 of all inbound email. Thirty-five percent of spam email contained malware, an increase of 3% over 2015.

There were similar increases on other fronts as well. Incidents involving Point of Sale (POS) systems, particularly in North America, increased from 22% in 2015 to 31% last year. More than 50% of the attacks that Trustwave investigated targeted payment card data on POS systems.

Even so, corporate and internal business networks continued to be the most breached environments in 2016, accounting for more than 4 in 10 of all breaches that Trustwave investigated.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
US Mayors Commit to Just Saying No to Ransomware
Robert Lemos, Contributing Writer,  7/16/2019
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12551
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, improper validation of arguments in the internal implementation of the Memcpy function (provided by the scripting engine) allows an attacker to overwrite arbitrary memory, which could lead to code execution.
CVE-2019-12552
PUBLISHED: 2019-07-22
In SweetScape 010 Editor 9.0.1, an integer overflow during the initialization of variables could allow an attacker to cause a denial of service.
CVE-2019-3414
PUBLISHED: 2019-07-22
All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front en...
CVE-2019-10102
PUBLISHED: 2019-07-22
tcpdump.org tcpdump 4.9.2 is affected by: CWE-126: Buffer Over-read. The impact is: May expose Saved Frame Pointer, Return Address etc. on stack. The component is: line 234: "ND_PRINT((ndo, "%s", buf));", in function named "print_prefix", in "print-hncp.c". Th...
CVE-2019-10102
PUBLISHED: 2019-07-22
aubio 0.4.8 and earlier is affected by: null pointer. The impact is: crash. The component is: filterbank. The attack vector is: pass invalid arguments to new_aubio_filterbank. The fixed version is: after commit eda95c9c22b4f0b466ae94c4708765eaae6e709e.