Research latest: IT managers are struggling to cope with cyberattacks

New research from Sophos suggests that two thirds of organisations were hit by a cyberattack last year. The report lists the three biggest reasons why organisations are still struggling to reduce their risk:

  • Attacks are coming in from multiple directions
  • Cyberattacks are multi-stage, coordinated and blended
  • Technology, talent and time are in short supply

Here’s a closer look at what the researchers found – and what all of this means for IT managers and anyone looking to strengthen their cybersecurity career credentials.

Table Of Contents

Add a header to begin generating the table of contents

Research findings in brief

Sophos commissioned an independent survey of 3,100 IT managers across 12 countries between December 2018 and January 2019.

Titled ‘The Impossible Puzzle of Cybersecurity’, the central message of the report is pretty clear: the game of cat and mouse between IT/Security professionals and cyber criminals continues unabated. Just as cybersecurity protection technologies are advancing, so too are the capabilities of threat actors – and overstretched IT/Security teams are struggling to stay on top.

Cybersecurity attack rates

68% of respondents said that their organisations were hit by a cybersecurity attack last year. Of those organisations that had been hit, the average number of attacks for the year was two. 10% of organisations had been hit by four or more attacks.

Nine in ten respondents whose organisations had been hit claimed to have up-to-date attack protection measures in place at the time of the attack. This provides a reminder of the need for organisations to operate in “assume breach” mode. In other words, you need to recognise that no matter how robust your perimeter protection, the risk of breach can never be completely eliminated.

​What keeps security managers awake at night? When asked to rank the consequences of cybersecurity breaches in order of importance, here’s how they responded:

  • Data loss. Almost a third of respondents placed this as their top concern – and more than two thirds had it in their top three. The message seems clear: to increase peace of mind, businesses need to ensure they are investing adequately in backup, recovery and data loss protection (DLP).
  • Cost. 21% of respondents cited cost of response as the biggest concern arising from cybersecurity attacks. Research from elsewhere suggests that these costs are on the rise. Ponemon found that for small to medium-size businesses, the average cost of a security breach increased by 61% from $229k in 2018 to $369k in 2019.
  • Business damage. 21% of respondents rated this as their top concern, while 56% listed it as a top three worry. PwC found that 85% of consumers will not do business with a company if they are worried about its security practices. The knock-on reputational effects of a significant cybersecurity attack can be at least as costly as the initial response costs.

Attacks from multiple directions

Email remains the most common attack vector, used in 33% of cases. The web comes a close second, used in 30% of attacks. 23% of attacks used software vulnerabilities as the means of entry, and 14% were launched via USB stick or other external devices.

For 20% of incidents, respondents were unable to identify the attack vector. This strongly suggests that effective incident response capabilities are absent in those organisations. As the report authors put it, “if you don’t know which security door has been left open, it’s hard to shut it”.

There are regional variations in the prevalence of these threat vectors. For instance, software vulnerabilities top the list for India, while a quarter of attacks in Mexico are via USB sticks/external devices.

Comment: Responding to the risk of attack from multiple vectors

The absence of a single, overwhelmingly popular vector shows that businesses need to take a multi-pronged approach to minimise the risk. This includes:

  • Spam filters, page blockers and policies warning against clicking on links/attachments from unknown sources to reduce the likelihood of email/web-based attacks.
  • Keeping on top of patch updates to reduce risks from software vulnerabilities.
  • Where practical, physical port restrictions at endpoint level to deal with the risk of attacks being introduced via USB drives & devices.

The nature of attacks: Multi-stage, coordinated and blended

Respondents suggested that attacks they had experienced included the following elements:

53% Phishing email
41% Data breach 
35% Malicious code 
35% Software exploit 
30% Ransomware 
21% Credential theft

These figures (far in excess of 100% as a whole) suggest that most organisations are experiencing multi-faceted attacks. Examples include users being successfully targeted with phishing messages, triggering the launch of malicious code leading to unlawful systems access violation, giving rise to a data breach.

Companies are short of technology, time and talent

On average, IT departments devote 26% of their time to managing cybersecurity. This may seem like a significant chunk of resources, but evidence suggests that it’s not enough. A lack of specialist human resources is a major issue, with 86% of managers saying that they require greater cybersecurity skills within their organisation.

One way of addressing this is for organisations to look for ways to do more with less: examples include enhanced security information and event management (SIEM) capabilities and increased automation in areas such as patch management, backups and reporting.

Individuals have a big role to play, too – not least when it comes to seeking out training opportunities to bridge the skills gap. One thing is particularly clear: with eight in ten organisations saying they are struggling to recruit security talent, those individuals who are ready and willing to boost their cybersecurity skills portfolio are likely to find themselves increasingly in demand.

CATEGORIES
  • Jay says:

    “… the need for organisations to operate in ‘assume breach’ mode.” This is probably a good starting point. Your decision makers will never be as paranoid as you. So show them their risks of potentially devastating losses, without sounding like “the boy who cried wolf”. Also, try to make it personal for them. Appealing to their fears seems a bit manipulative, but remember that you’re trying to move them to properly assess their risks.

    • Guest says:

      Interesting point yeah.. but ya see, IT Managers, tend to get stuck in a Cindarella Complex, and then there are fun things called The 7 Deadly Sins of IT. Risk Mamagement clearly isnt for everyone.. But I do agree with your point on making it more customized to the need of the organization, that is what Consultants do.

  • Jim says:

    I often wonder how much time is devoted to assessing the risks. In the first instance any data loss could leave any business reputation which they spend years in building up completely in ruins with customers leaving in droves. Cybersecurity has to be given the highest priority.

  • kirstongary says:

    Thanks for the information. Yes, IT managers are struggling a lot with cyber attacks especially for the small business they are suffering alot.To prevent them and protect ourselves we should Cybersecurity.

  • kirstongary says:

    Thanks for the information. Yes, due to cyberattacks now-a-days IT companies are suffering a lot and the managers of that companies are could not able to defend those attacks. So, they are using cybersecurity now-a-days to prevent these cyberattacks and protect themselves.

  • Alishia says:

    Hi Nathan, there will always be growth in web applications and cloud solutions to revolutionize businesses, and other aspects of life, but with it also comes global exposure to attacks and the organizations’ wrong thinking about cyberattacks is that cyberattacks are something that only happens to others. But cybercriminals are increasingly targeting the data and this means that every business has something valuable and can be a viable target.

  • >