Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/20/2017
05:17 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Organizations Are Detecting Intrusions More Quickly

But almost every other metric in Trustwave's 2017 global cybersecurity report card is headed in the wrong direction.

More organizations appear to be heeding the advice to implement capabilities for detecting intrusions sooner, at least based on an analysis of data from breach investigations that security vendor Trustwave conducted for clients last year.

Trustwave's analysis showed that the median number of days from an intrusion to initial detection of the compromise fell sharply from 80.5 days in 2015 to 49 days in 2016. In other words, out of all organizations for which Trustwave conducted a breach investigation last year, half discovered the breach in 49 days or less, while half took longer.

The overall range was zero to 2,000 days, meaning at least one breached organization discovered the intrusion in less than one day, while at least one took more than five years.

The news was even better for internally detected data breaches. For organizations that detected an intrusion on their own, the median was 16 days, compared to 65 days for breaches that were externally detected. Once a breach was detected, the median duration of the time to containment was 153 days.

The numbers are welcome news in an industry where most statistics, especially those that are breach-related, tend only to go upwards most of the time.

"Security is starting to take a front seat to important buying decisions," says Brian Hussey, Trustwave's vice president of cyber threat detection and response. "Organizations are tired of being hit with costly clean-up following a security breach and recognize the immediate and long term value in always-on visibility and detection," he says.

Gartner recently reported the same trend. According to the analyst firm, detection and response technologies has become a top spending priority for organizations. Gartner expects it will remain that way through at least 2020 as organizations finally begin to shift away from prevention-only security strategies.

The trend does not mean that enterprises are abandoning prevention technologies completely. But it does send the message that "prevention is futile unless it is tied into a detection and response capability," Gartner analyst Sid Deshpande wrote.

Somewhat predictably though, the rest of the news in Trustwave's report was less encouraging. A stunning 99.7% of web applications that Trustwave's scanning services tested last year had at least one vulnerability. A majority had a lot more with the average detected being 11 vulnerabilities per application. The universe of vulnerable applications included banking apps, financial apps, games, productivity apps, and corporate applications.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

The most significant findings in Trustwave's report, says Hussey, related to the number of zero-day vulnerabilities exploited in the wild targeted at Adobe Flash Player, Microsoft Silverlight, and Internet Explorer.

"For opportunistic cybercriminals, vulnerabilities in code - particularly content management systems - represent an express lane to a reward destination," he says. Even a single exploitable vulnerability in a popular CMS can give attackers a way to steal user data or host exploits on potentially thousands of web servers, he says.

Application vulnerabilities were not the only bit of bad news in the Trustwave report. The company's analysis showed a massive 54% jump in spam email in 2016 compared to the year before. Spam emails accounted for as many as six in 10 of all inbound email. Thirty-five percent of spam email contained malware, an increase of 3% over 2015.

There were similar increases on other fronts as well. Incidents involving Point of Sale (POS) systems, particularly in North America, increased from 22% in 2015 to 31% last year. More than 50% of the attacks that Trustwave investigated targeted payment card data on POS systems.

Even so, corporate and internal business networks continued to be the most breached environments in 2016, accounting for more than 4 in 10 of all breaches that Trustwave investigated.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.