Organizations Are Detecting Intrusions More Quickly

But almost every other metric in Trustwaves 2017 global cybersecurity report card is headed in the wrong direction.

More organizations appear to be heeding the advice to implement capabilities for detecting intrusions sooner, at least based on an analysis of data from breach investigations that security vendor Trustwave conducted for clients last year.
Trustwaves
analysis
showed that the median number of days from an intrusion to initial detection of the compromise fell sharply from 80.5 days in 2015 to 49 days in 2016. In other words, out of all organizations for which Trustwave conducted a breach investigation last year, half discovered the breach in 49 days or less, while half took longer.
The overall range was zero to 2,000 days, meaning at least one breached organization discovered the intrusion in less than one day, while at least one took more than five years.
The news was even better for internally detected data breaches. For organizations that detected an intrusion on their own, the median was 16 days, compared to 65 days for breaches that were externally detected. Once a breach was detected, the median duration of the time to containment was 153 days.
The numbers are welcome news in an industry where most statistics, especially those that are breach-related, tend only to go upwards most of the time.
Security is starting to take a front seat to important buying decisions, says Brian Hussey, Trustwaves vice president of cyber threat detection and response. Organizations are tired of being hit with costly clean-up following a security breach and recognize the immediate and long term value in always-on visibility and detection, he says.
Gartner
recently reported
the same trend. According to the analyst firm, detection and response technologies has become a top spending priority for organizations. Gartner expects it will remain that way through at least 2020 as organizations finally begin to shift away from prevention-only security strategies.
The trend does not mean that enterprises are abandoning prevention technologies completely. But it does send the message that prevention is futile unless it is tied into a detection and response capability, Gartner analyst Sid Deshpande wrote.
Somewhat predictably though, the rest of the news in Trustwaves report was less encouraging. A stunning 99.7% of web applications that Trustwaves scanning services tested last year had at least one vulnerability. A majority had a lot more with the average detected being 11 vulnerabilities per application. The universe of vulnerable applications included banking apps, financial apps, games, productivity apps, and corporate applications.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
and
to register.
The most significant findings in Trustwaves report, says Hussey, related to the number of zero-day vulnerabilities exploited in the wild targeted at Adobe Flash Player, Microsoft Silverlight, and Internet Explorer.
For opportunistic cybercriminals, vulnerabilities in code - particularly content management systems - represent an express lane to a reward destination, he says. Even a single exploitable vulnerability in a popular CMS can give attackers a way to steal user data or host exploits on potentially thousands of web servers, he says.
Application vulnerabilities were not the only bit of bad news in the Trustwave report. The companys analysis showed a massive 54% jump in spam email in 2016 compared to the year before. Spam emails accounted for as many as six in 10 of all inbound email. Thirty-five percent of spam email contained malware, an increase of 3% over 2015.
There were similar increases on other fronts as well. Incidents involving Point of Sale (POS) systems, particularly in North America, increased from 22% in 2015 to 31% last year. More than 50% of the attacks that Trustwave investigated targeted payment card data on POS systems.
Even so, corporate and internal business networks continued to be the most breached environments in 2016, accounting for more than 4 in 10 of all breaches that Trustwave investigated.
Related content:
Security Chatbots Aim To Simplify Incident Detection And Response
Incident Response A Challenge For 98% Of InfoSec Pros
Spam Now Makes Up Nearly Two-Thirds Of All Email
10 Essential Elements For Your Incident-Response Plan

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Organizations Are Detecting Intrusions More Quickly