Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/7/2013
07:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Survey Exposes The Dirty Little Secret Of Undisclosed Breaches

Nearly 70 percent of U.S. security pros say complexity and volume of malware attacks hinder their defenses

Nearly 60 percent of malware investigations in U.S. enterprises involve data breaches that were not disclosed, according to new research.

Some 66 percent of security professionals at U.S. companies with more than 500 employees say they have investigated or worked on a breach that was not disclosed by their organizations, while 57 percent said they had worked on a data breach that went unreported, according to a survey of 200 security professionals by OpinionMatters, which was commissioned by ThreatTrack.

"While it is discouraging that so many malware analysts are aware of data breaches that enterprises have not disclosed, it is no surprise that the breaches are occurring," says Julian Waits, CEO at ThreatTrack. "Every day, malware becomes more sophisticated, and U.S. enterprises are constantly targeted for cyberespionage campaigns from overseas competitors and foreign governments. This study reveals that malware analysts are acutely aware of the threats they face, and while many of them report progress in their ability to combat cyberattacks, they also point out deficiencies in resources and tools."

Senior executives' devices become infected 56 percent of the time due to their opening a malicious URL in a phishing email, 45 percent of the time after letting a family member use a company-owned device, 40 percent of the time due to visiting a pornographic website, and 33 percent for installing a malicious mobile app.

Around 40 percent of the IT pros say one of their biggest challenges is they don't have the security staff resources they need. Some 67 percent say malware complexity is the hardest part of protecting their networks; 67 percent, the volume of malware attacks; and 58 percent, ineffective anti-malware products.

It takes more than two hours for more than half of security pros to analyze a new malware sample, and 4 percent say it takes them less than an hour.

A white paper on the report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
11/14/2013 | 7:59:52 AM
re: Survey Exposes The Dirty Little Secret Of Undisclosed Breaches
In order to think strategically about the investments in security, itGs important to define
and measure the risks. In our recent survey on application security maturity, we found that the use of a threat model or other high-level risk assessment is exhibited by only 43% of surveyed organizations. This lack of measurement makes it very difficult to invest effectively or to improve over time the state of security application.

To better understand this, I recommend checking out the key findings from the research in this series of articles on our blog: http://blog.securityinnovation...

Hope you find it useful!
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14540
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-16332
PUBLISHED: 2019-09-15
In the api-bearer-auth plugin before 20190907 for WordPress, the server parameter is not correctly filtered in the swagger-config.yaml.php file, and it is possible to inject JavaScript code, aka XSS.
CVE-2019-16333
PUBLISHED: 2019-09-15
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
CVE-2019-16334
PUBLISHED: 2019-09-15
In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: this may overlap CVE-2017-16636.
CVE-2019-16335
PUBLISHED: 2019-09-15
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.