Tripwire has published the results of a new study conducted in partnership with Dimensional Research. The study looked at the key attack types expected to cause the biggest security problems in 2017 and evaluated how successful businesses will be at defending against those attacks. Study respondents included 403 IT security professionals at companies with more than 1,000 employees based in the U.S., U.K., Canada and Europe. “The results of this study highlight that there are very few organizations equipped to deal with all of today’s major attack types. Most organizations can reasonably handle one or two key threats, but the reality is they need to be able to defend against them all”
Tripwire’s study revealed that only three percent of organizations have the technology and only 10 percent have the skills in place to address today’s top attack types, highlighting a gaping hole in many organizations’ cyber defenses that can be discovered and taken advantage of by hackers. According to the study, ransomware has the potential to inflict the most significant damage to organizations in 2017, yet not even half of those surveyed have the skills (44 percent) or the technology (43 percent) to effectively address it.
“The results of this study highlight that there are very few organizations equipped to deal with all of today’s major attack types. Most organizations can reasonably handle one or two key threats, but the reality is they need to be able to defend against them all,” said Tim Erlin, senior director of IT security and risk strategy for Tripwire. “As part of the study, we asked respondents which attack types have the potential to do the greatest amount of damage to their organization. While ransomware was cited as the top threat, all organizations were extremely concerned about phishing, insider threats, vulnerability exploitation and DDoS attacks.”
The study’s respondents were also asked about their skills and technology, specific to each of the attack types. Tripwire found that most felt confident in their skills to tackle phishing (68 percent) and DDoS attacks (60 percent), but less confident in their abilities to address insider threats (48 percent), vulnerability exploitations (45 percent) and ransomware (44 percent). Regarding technology, the findings once again revealed more confidence in addressing phishing (56 percent) and DDoS attacks (63 percent), with less than half of the companies having the technology to address ransomware (43 percent), insider threats (41 percent) and vulnerabilities (40 percent).
Erlin added: “We can see from these results that under half of organizations have either the technology or skills in place to address ransomware, insider threats and vulnerability exploitation, which is very concerning. These are all very real threats, which almost all organizations will face at some point in time. The unfortunate reality is that today’s determined cybercriminals will target organizations with a variety of different attack techniques until they are successful. Organizations need to work with security vendors that have the ability to help them address all of today’s major attack types, while also offering IT teams with training to help educate them on new trends.”
The findings of Tripwire’s study indicated that foundational security controls would help address these challenges. While two out of three respondents stated they use security standards or frameworks that include a set of foundational controls, 93 percent responded “yes” when asked if the adoption of foundational security controls would improve their readiness to protect against new security threats.
Additional key findings from the study include:
- The enforcement of foundational security controls is challenging, with 65 percent of respondents indicating they lack the ability to effectively enforce them.
- Sixty-four percent of respondents believe financial services will be hit hardest by cybercriminals in 2017.
- While U.S. respondents were more concerned about the health care sector (46 percent), European respondents were more concerned about telecommunications companies (59 percent).
