Story image

Businesses are more aware of cybercrime but still not prepared

29 Mar 18

New research has emerged that reveals better cybersecurity awareness doesn’t necessarily mean better preparation.

Commissioned by SolarWinds MSP and undertaken by the Ponemon Institute, the study asked 202 senior-level security executives in the US and the UK about emerging security threats.

Specifically, the study addressed those propagated by the “Vault 7” leaks, and the more massive global WannaCry and Petya ransomware attacks fueled by the “EternalBlue” Shadow Brokers leak.

Despite the majority being in agreement that cyberattacks are on the rise, most are confused about what threats pose the most risk as well as lacking the means to defend against them.

Less than half (45 percent) said they had the technology to prevent, detect and contain cybersecurity threats, while just 47 percent felt that they had enough budget.

While 69 percent of respondents had a high awareness of both WannaCry and Petya threats, they were far less aware of the potential of Vault 7 threats, with the highest level of awareness at 30 percent.

“The lack of knowledge among senior-level security executives is worrying—they know that attacks are on the increase, but many don’t know what they are and seem unable to effectively prevent them,” says Ponemon Institute founder Larry Ponemon.

“Better use needs to be made of the resources available, such as US CERT alerts, and the service providers that most businesses are using to outsource protection. Those providers also need to step up and provide education on where most attacks are coming from and how they can be prevented.”

Potentially even more worrying than the confusion over risk was the actual number of attacks that had been detected, with 54 percent admitting that their businesses had experienced an attack in the last year. Of those, 47 percent had been unable to prevent the attack.

The result of these successful cyberattacks included the theft of data assets (52 percent), the disruption to business process (47 percent), and IT downtime (41 percent).

Some of the other findings include:

  • 29 percent said that they would be unable to prevent a Petya attack and 28 percent would be unable to prevent a WannaCry attack
  • Businesses are even less prepared for Vault 7 exploit attacks, with only 9 percent ready to prevent exploits of Vault 7 threats like Dark Matter or After Midnight
  • 44% of respondents who were aware of the WannaCry patch didn’t implement it
  • 55% didn’t patch for Petya

“There is a role for managed service providers (MSPs) to play based on this research, by supporting companies as they navigate the ever-evolving security threats businesses face. It’s a bit like the wild west now, as we saw from the widespread fallout from WannaCry and Petya, and may still see from Vault 7 if those leaks are more widely exploited,” says SolarWinds MSP VP of security architecture Tim Brown.

“Indeed, we have no crystal ball to know what threats lie on the horizon. Businesses need help with everything from awareness to technology to specialized staff. This study supports a view that MSPs have a unique opportunity to expand their security offerings to meet this need by filling gaps that can’t be easily filled in house.”

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”
Malware downloader on the rise in Check Point’s latest Threat Index
Organisations continue to be targeted by cryptominers, despite an overall drop in value across all cryptocurrencies in 2018.
IoT breaches: Nearly half of businesses still can’t detect them
The Internet of Thing’s (IoT’s) rapid rise to prominence may have compromised its security, if a new report from Gemalto is anything to go by.