Posted at 11:00 - 1st July - Angela Mitchel - Vacation
Posted at 11:00 - 1st July - Angela Mitchel - Vacation
Article originally published on Yahoo News HERE
Find IBM's Study HERE
With employees working more from home many companies are rethinking their cybersecurity plans.
Breaches are up 175% compared to this time last year. Companies have increased their cybersecurity standing but they haven't gone far enough yet.
Since the coronavirus hit the U.S. in full force in March, spam emails are up 6,000%. This data from the head of IBM’s X-Force Threat Intelligence, Wendi Whitmore, showed the scale of the opportunity provided to scammers by the pandemic and resulting economic crisis.
The surge is, in part, connected to the high numbers of people working from home. Compared to last year at this time, breaches are up 175%.
“Breaches are occurring at a huge volume on a daily basis,” Whitmore told Yahoo Finance.
Since the lockdowns began, cybersecurity experts began to worry that it would be easier for attackers to compromise security systems. The fear of the pandemic, financial stress, and other distractions at home turned workers into ripe targets for scammers, as stress lowers people’s guard to tactics like phishing.
In the case of workers using VPNs, some experts see them as the perfect way to get a bad actor into a company’s network, likening it to a hypodermic needle. All an attacker needs is a few employees to click on some malware, perhaps from an email or a fake resume and they could be in — and some cyber experts even speculated that attackers might target unsecured Wi-Fi networks.
IBM’s fifth annual Cyber Resilient Organization Report found this is an especially risky time, and Whitmore told Yahoo Finance that this matched with what her team is seeing in the field.
Companies are doing more on security, but often the defenses for these more acute threats are not enough.
Around 51% of organizations have experienced a significant disruption because of a cybersecurity incident, according to the study, but there remain issues about how companies see defense. Whitmore said companies often buy defenses and expect them to work without integration or continued attention to defense measures.
“Tools must be part of the business process,” said Whitmore, noting that while cloud computing has been a positive, it’s also muddled the company’s understanding of who is responsible for guarding data — and that companies can figure out access issues if the data isn’t hosted on the company premises.
Right now, Whitmore said, one unique threat has emerged: interest in theft of intellectual property related to Covid-19 vaccine and testing information, the scale of which is on a nation-state level.
With cloud services, while they are incredibly important to security, but employees tend to believe that they no longer have responsibilities to be on guard from security leaks.
Find IBM's Study HERE
CAMBRIDGE, Mass., June 30, 2020 /PRNewswire/ -- IBM (NYSE: IBM) Security today announced the results of a global report examining businesses' effectiveness in preparing for and responding to cyberattacks. While organizations surveyed have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13% during this same period. The global survey conducted by Ponemon Institute and sponsored by IBM Security found that respondents' security response efforts were hindered by the use of too many security tools, as well as a lack of specific playbooks for common attack types.
While security response planning is slowly improving, the vast majority of organizations surveyed (74%) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all. This lack of planning can impact the cost of security incidents, as companies that have incident response teams and extensively test their incident response plans spend an average of $1.2 million less on data breaches than those who have both of these cost-saving factors in place.1
The key findings of those surveyed from the fifth annual Cyber Resilient Organization Report include:
"While more organizations are taking incident response planning seriously, preparing for cyberattacks isn't a one and done activity," said Wendi Whitmore, Vice President of IBM X-Force Threat Intelligence. "Organizations must also focus on testing, practicing and reassessing their response plans regularly. Leveraging interoperable technologies and automation can also help overcome complexity challenges and speed the time it takes to contain an incident."
Updating Playbooks for Emerging Threats
The survey found that even amongst organizations with a formal cybersecurity incident response plan (CSIRP), only 33% had playbooks in place for specific types of attacks. Since different breeds of attack require unique response techniques, having pre-defined playbooks provides organizations with consistent and repeatable action plans for the most common attacks they are likely to face.
Amongst the minority of responding organizations who do have attack-specific playbooks, the most common playbooks are for DDoS attacks (64%) and malware (57%). While these methods have historically been top issues for the enterprise, additional attack methods such as ransomware are on the rise. While ransomware attacks have spiked nearly 70% in recent years,2 only 45% of those in the survey using playbooks had designated plans for ransomware attacks.
Additionally, more than half (52%) of those with security response plans said they have never reviewed or have no set time period for reviewing or testing those plans. With business operations changing rapidly due to an increasingly remote workforce, and new attack techniques constantly being introduced, this data suggests that surveyed businesses may be relying on outdated response plans which don't reflect the current threat and business landscape.
More Tools Led to Worse Response Capabilities
The report also found that complexity is negatively impacting incident response capabilities. Those surveyed estimated their organization was using more than 45 different security tools on average, and that each incident they responded to required coordination across around 19 tools on average. However, the study also found that an over-abundance of tools may actually hinder organizations ability to handle attacks. In the survey, those using more than 50 tools ranked themselves 8% lower in their ability to detect an attack (5.83/10 vs. 6.66/10), and around 7% lower when it comes to responding to an attack (5.95/10 vs. 6.72/10).
These findings suggest that adopting more tools didn't necessarily improve security response efforts — in fact, it may have done the opposite. The use of open, interoperable platforms as well as automation technologies can help reduce the complexity of responding across disconnected tools. Amongst high-performing organizations in the report, 63% said the use of interoperable tools helped them improve their response to cyberattacks.
Better Planning Pays Off
This year's report suggests that surveyed organizations who invested in formal planning were more successful in responding to incidents. Amongst respondents with a CSIRP applied consistently across the business, only 39% experienced an incident that resulted in a significant disruption to the organization within the past two years compared to 62% of those who didn't have a formal plan in place.
Looking at specific reasons that these organizations cited for their ability to respond to attacks, security workforce skills were found to be a top factor. 61% of those surveyed attributed hiring skilled employees as a top reason for becoming more resilient; amongst those who said their resiliency did not improve, 41% cited the lack of skilled employees as the top reason.
Technology was another differentiator that helped organizations in the report become more cyber resilient, especially when it comes to tools that helped them resolve complexity. Looking at organizations with higher levels of cyber resilience, the top two factors cited for improving their level of cyber resilience were visibility into applications and data (57% selecting) and automation tools (55% selecting). Overall, the data suggests that surveyed organizations that were more mature in their response preparedness relied more heavily on technology innovations to become more resilient.