Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

12/19/2018
08:15 AM
Jeffrey Burt
Jeffrey Burt
Jeffrey Burt
50%
50%

Many Enterprises Still Blind to Security Risk, Study Finds

Even as organizations continue to get hit with cyber attacks, they're struggling to accurately measure the costs of such events to their operations, a report by Tenable and the Ponemon Institute found.

A majority of companies around the world have sustained at least two cyber attacks that have disrupted their operations over the last two years, but many organizations are still unclear about the costs to their businesses of such attacks.

Specifically, 60% of organizations over the past 24 months have endured cyber attacks that have either exposed sensitive data, caused disruption or temporarily shut down their business operations or equipment, while 91% had been the victim of at least one such attack, according to a recent study released by cybersecurity vendor Tenable.

However, the study, "Measuring and Managing Cyber Risks to Business Operations Report," conducted by Ponemon Institute, also found that 54% of organizations aren't measuring the business costs of such cyber attacks, which means they have no way of accurately measuring their risk or making risk-based decisions based on quantifiable data. This presents a significant problem for businesses, given the complexities of their increasingly connected IT environments due to such trends as the Internet of Things (IoT), the cloud, greater mobility and DevOps, according to Tenable officials. (See Five IoT Endpoint Security Recommendations for the Enterprise.)

"The lack of cybersecurity maturity present in many enterprises creates real-world problems," Gavin Millard, vice president of intelligence at Tenable, told Security Now in an email. "One of the more critical issues is a lack of actionable insight into an organization's true level of exposure. Other potential consequences include downtime of critical systems, customer turnover, loss of market share and financial loss. In today's digital era, cyber risk is business risk. This means that organizations must not only understand where they are exposed and to what extent, but they must also have the resources, processes and technology in place to actively reduce their risk."

Digital transformation changes the game
The report -- in which 2,410 IT and information security officials in six countries were surveyed -- found the ongoing digital transformation at organizations has created a large attack surface while making it difficult for companies to fully understand their risk exposure.

Only 29% of respondents reported that they had sufficient visibility into their attack surface -- which includes traditional IT environments as well as the cloud, containers, IoT and operational technology -- to reduce their chances of being impacted by a cyber attack, while 58% told researchers that they don't have enough security staffing to scan for vulnerabilities as well as they need to.

Of those surveyed, 35% report that they only scan when it's needed to protect sensitive data.

Even those organizations that do measure the risks to their businesses posed by cyber attacks are unsure about what they're doing. The survey found that 62% of them aren't confident in the accuracy of the metrics they're using, so many of them are making business decisions without such information as the cost from IP thefts or the loss of revenue or productivity.

"Digital transformation is putting immense pressure on security teams as they work to keep their dynamic IT environments secure," Millard added. "At the same time, they're saddled with security tools and approaches created for the old-world of on-premises servers and workstations. The security industry -- vendors and security organizations alike -- have not kept pace with today's digital enterprise, leaving organizations everywhere exposed as the attack surface continues to expand."

IoT concerns
The far-reach connectivity inherent in modern computing environments makes cybersecurity even more challenging. Millard noted that few IoT devices are made with security in mind, which means they don't have the same baseline security requirements that organizations look for. In addition, the security risk is increased when employees bring such devices into the corporate environment without the security team's knowledge or approval.

"Many organizations have quickly realized that IoT has expanded their attack surface and are actively working to manage, measure and reduce the cyber risk the devices introduce," he said. "On the other hand, some organizations are still flying blind when it comes to securing IoT and are unable to identify all of the assets, including transient devices, that are connected to their network."

Researchers with NetScout's ASERT recently found that IoT devices are the targets of increasingly sophisticated botnet attacks that exploit vulnerabilities and attack devices sometimes within minutes of them coming online. That report came soon after another from Trend Micro, which said that the Message Queuing Telemetry Transport (MQTT) protocol and Constrained Application Protocol (CoAP), which are crucial to the machine-to-machine communications that underpin the IoT, are rife with vulnerabilities. (See M2M Protocols Expose IoT Data, Trend Micro Finds.)

In addition to IoT security challenges, businesses are increasingly finding themselves at risk due to security issues of their supply chain partners and others outside of the company.

"The modern attack surface is no longer confined to your corporate network alone," Millard wrote. "Organizations now rely on third parties in the form of consultants, contract workers, partners and property managers, to conduct day-to-day business. The data, systems and assets that are owned, controlled and/or stored by these third parties represent an organization's expanding attack surface. While your corporate security posture might be strong, a weak link in your supply chain can be used to compromise your data or assets."

Related posts:

— Jeffrey Burt is a long-time tech journalist whose work has appeared in such publications as eWEEK, The Next Platform and Channelnomics.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...