Threat Intelligence

10:45 AM
Dark Reading
Dark Reading
Products and Releases

Faster Cyberattack Detection Can Limit Business Impact by 70%: Cyber adAPT, Aberdeen Group

July 11, 2017 – Half Moon Bay, California – A new report released today, commissioned by Cyber adAPT and conducted by Aberdeen Group, has revealed that cyber attack detection and response times have a critical status in protecting access to infrastructure and data within modern networks.

New insight detailed in the report entitled ‘The need for speed: faster detection requires a new type of platform’, reveals that doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.

The report also shows that improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.

Monte Carlo analysis: Reducing the Business Impact of Disruptions and Data Breaches

Source: Monte Carlo analysis; Aberdeen Group June 2017

The findings help contextualize the current cyber security climate, which McKinsey and the World Economic Forum has previously described as one where 60% of technology executives agree the sophistication as well as the pace of attacks will increase faster than the ability of institutions to defend themselves[i].

The report also consolidates existing research from Aberdeen Group, which found:

  • Two out of five (39%) organizations are moving from a traditional, PC-oriented computing environment toward an increasingly mobile-first infrastructure, and half (49%) of all respondents have already invested in connected devices (IoT) initiatives[ii].
  • In a study of 3,000 current network firewall installations nearly half (46%) of all organizations were dealing with multiple sites and/or multiple firewall vendors[iii].
  • In an analysis of nearly 11,000 security monitoring and analytics installations, two-thirds of CISOs are taking a tools-based approach to cyber security, installing a single product at a single site. The remaining third of installations typified a platform approach[iv].
  • In current technology installations of virtualization and cloud computing initiatives involving 336 products from 57 vendors, there were more than 1.6 billion permutations in the simple six-layer stack[v].

The report describes a dynamic infrastructure, which includes a mix of traditional servers, private clouds, and public clouds as “the new normal”, and notes that its complexity means that using prevention-led methods cannot be successful 100% of the time.

Kirsten Bay, President and CEO of Cyber adAPT commented on the new insights and wider report: “Criminals are gaining access to our networks regardless of how much money has been sent on perimeter defenses. The unique, new insights released today demonstrate the pressing need for CISOs to be able to quickly detect these inevitable breaches and act upon them immediately, if they are to limit the impact.[vi]

Bay continues:

“Furthermore, the report identifies that today’s enterprise computing infrastructure is increasingly digital, edgeless and hybrid. With a vast number of firewall installations and other security tools to manage, the data demonstrates that a strategy focused on prevention alone is no longer enough – detecting anomalies and defending this blurred perimeter is simply beyond human capability.”

Derek Brink, Vice President and Research Fellow, Aberdeen Group and author of the report commented: “Our report shows that in securing increasingly complex computing infrastructures CISOs have a bastion of tools at their disposal. But this has only served to deliver an onslaught of alerts, which take time to filter. To regain their time advantage against attackers, CISOs need a single platform, which integrates data from multiple sources and offers optimized visibility into a rapidly changing threat landscape. This will allow them to detect threats in real-time and respond before attackers compromise information and remove access to vital infrastructure.”

Key insights:

  • When it comes to detection, response and recovery time are crucial.
  • CISOs need to make the business case for how faster detection, effective response, and rapid recovery reduces the impact of attacks.
  • Doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.
  • Improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.
  • Today’s enterprise computing infrastructure is a dynamic blend of traditional networks, expanding user bases, a mix of private and public clouds, and connected devices.
  • In such an environment, timely detection of active attacks – at the scale and speed needed – requires a new type of platform.


Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
Securing Social Media: National Safety, Privacy Concerns
Kelly Sheridan, Staff Editor, Dark Reading,  4/19/2018
Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training
Sara Peters, Senior Editor at Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.