Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/7/2013
07:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Survey Exposes The Dirty Little Secret Of Undisclosed Breaches

Nearly 70 percent of U.S. security pros say complexity and volume of malware attacks hinder their defenses

Nearly 60 percent of malware investigations in U.S. enterprises involve data breaches that were not disclosed, according to new research.

Some 66 percent of security professionals at U.S. companies with more than 500 employees say they have investigated or worked on a breach that was not disclosed by their organizations, while 57 percent said they had worked on a data breach that went unreported, according to a survey of 200 security professionals by OpinionMatters, which was commissioned by ThreatTrack.

"While it is discouraging that so many malware analysts are aware of data breaches that enterprises have not disclosed, it is no surprise that the breaches are occurring," says Julian Waits, CEO at ThreatTrack. "Every day, malware becomes more sophisticated, and U.S. enterprises are constantly targeted for cyberespionage campaigns from overseas competitors and foreign governments. This study reveals that malware analysts are acutely aware of the threats they face, and while many of them report progress in their ability to combat cyberattacks, they also point out deficiencies in resources and tools."

Senior executives' devices become infected 56 percent of the time due to their opening a malicious URL in a phishing email, 45 percent of the time after letting a family member use a company-owned device, 40 percent of the time due to visiting a pornographic website, and 33 percent for installing a malicious mobile app.

Around 40 percent of the IT pros say one of their biggest challenges is they don't have the security staff resources they need. Some 67 percent say malware complexity is the hardest part of protecting their networks; 67 percent, the volume of malware attacks; and 58 percent, ineffective anti-malware products.

It takes more than two hours for more than half of security pros to analyze a new malware sample, and 4 percent say it takes them less than an hour.

A white paper on the report is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
11/14/2013 | 7:59:52 AM
re: Survey Exposes The Dirty Little Secret Of Undisclosed Breaches
In order to think strategically about the investments in security, itGs important to define
and measure the risks. In our recent survey on application security maturity, we found that the use of a threat model or other high-level risk assessment is exhibited by only 43% of surveyed organizations. This lack of measurement makes it very difficult to invest effectively or to improve over time the state of security application.

To better understand this, I recommend checking out the key findings from the research in this series of articles on our blog: http://blog.securityinnovation...

Hope you find it useful!
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.