Threat Intelligence

7/12/2017
10:45 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Faster Cyberattack Detection Can Limit Business Impact by 70%: Cyber adAPT, Aberdeen Group

July 11, 2017 – Half Moon Bay, California – A new report released today, commissioned by Cyber adAPT and conducted by Aberdeen Group, has revealed that cyber attack detection and response times have a critical status in protecting access to infrastructure and data within modern networks.

New insight detailed in the report entitled ‘The need for speed: faster detection requires a new type of platform’, reveals that doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.

The report also shows that improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.

Monte Carlo analysis: Reducing the Business Impact of Disruptions and Data Breaches

Source: Monte Carlo analysis; Aberdeen Group June 2017

The findings help contextualize the current cyber security climate, which McKinsey and the World Economic Forum has previously described as one where 60% of technology executives agree the sophistication as well as the pace of attacks will increase faster than the ability of institutions to defend themselves[i].

The report also consolidates existing research from Aberdeen Group, which found:

  • Two out of five (39%) organizations are moving from a traditional, PC-oriented computing environment toward an increasingly mobile-first infrastructure, and half (49%) of all respondents have already invested in connected devices (IoT) initiatives[ii].
  • In a study of 3,000 current network firewall installations nearly half (46%) of all organizations were dealing with multiple sites and/or multiple firewall vendors[iii].
  • In an analysis of nearly 11,000 security monitoring and analytics installations, two-thirds of CISOs are taking a tools-based approach to cyber security, installing a single product at a single site. The remaining third of installations typified a platform approach[iv].
  • In current technology installations of virtualization and cloud computing initiatives involving 336 products from 57 vendors, there were more than 1.6 billion permutations in the simple six-layer stack[v].

The report describes a dynamic infrastructure, which includes a mix of traditional servers, private clouds, and public clouds as “the new normal”, and notes that its complexity means that using prevention-led methods cannot be successful 100% of the time.

Kirsten Bay, President and CEO of Cyber adAPT commented on the new insights and wider report: “Criminals are gaining access to our networks regardless of how much money has been sent on perimeter defenses. The unique, new insights released today demonstrate the pressing need for CISOs to be able to quickly detect these inevitable breaches and act upon them immediately, if they are to limit the impact.[vi]

Bay continues:

“Furthermore, the report identifies that today’s enterprise computing infrastructure is increasingly digital, edgeless and hybrid. With a vast number of firewall installations and other security tools to manage, the data demonstrates that a strategy focused on prevention alone is no longer enough – detecting anomalies and defending this blurred perimeter is simply beyond human capability.”

Derek Brink, Vice President and Research Fellow, Aberdeen Group and author of the report commented: “Our report shows that in securing increasingly complex computing infrastructures CISOs have a bastion of tools at their disposal. But this has only served to deliver an onslaught of alerts, which take time to filter. To regain their time advantage against attackers, CISOs need a single platform, which integrates data from multiple sources and offers optimized visibility into a rapidly changing threat landscape. This will allow them to detect threats in real-time and respond before attackers compromise information and remove access to vital infrastructure.”

Key insights:

  • When it comes to detection, response and recovery time are crucial.
  • CISOs need to make the business case for how faster detection, effective response, and rapid recovery reduces the impact of attacks.
  • Doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.
  • Improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.
  • Today’s enterprise computing infrastructure is a dynamic blend of traditional networks, expanding user bases, a mix of private and public clouds, and connected devices.
  • In such an environment, timely detection of active attacks – at the scale and speed needed – requires a new type of platform.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11486
PUBLISHED: 2019-04-23
The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel before 5.0.8 has multiple race conditions.
CVE-2019-11487
PUBLISHED: 2019-04-23
The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hu...
CVE-2018-7576
PUBLISHED: 2019-04-23
Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent.
CVE-2018-8825
PUBLISHED: 2019-04-23
Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local).
CVE-2019-10688
PUBLISHED: 2019-04-23
VVX products using UCS software version 5.8.0 and earlier with Better Together over Ethernet Connector (BToE) application version 3.8.0 and earlier uses hard-coded credentials to establish a connection between the host application and device.