Connect with us

E-Business

IT Managers are Inundated with Cyberattacks, Struggling to Keep Up, Says Sophos Global Survey

Published

on

Spread the love

Sophos, a global leader in network and endpoint security, has announced the findings of its global survey, The Impossible Puzzle of Cybersecurity, which reveals that IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up to date technology.

 

The survey polled 3,100 IT decision makers from mid-sized businesses in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.

 

Cybercriminals Use Multiple Attack Methods and Payloads for Maximum Impact

The Sophos survey shows how attack techniques are varied and often multi-staged, increasing the difficulty to defend networks.

 

One in five IT managers surveyed didn’t know how they were breached, and the diversity of attack methods means no one defensive strategy is a silver bullet.

 

“Cybercriminals are evolving their attack methods and often use multiple payloads to maximize profits. Software exploits were the initial point of entry in 23 percent of incidents, but they were also used in some fashion in 35 percent of all attacks, demonstrating how exploits are used at multiple stages of the attack chain,” said Chester Wisniewski, principal research scientist, Sophos.

 

“Organizations that are only patching externally facing high-risk servers are left vulnerable internally and cybercriminals are taking advantage of this and other security lapses.”

 

The wide range, multiple stages and scale of today’s attacks are proving effective. For example, 53 percent of those who fell victim to a cyberattack were hit by a phishing email, and 30 percent by ransomware. Forty-one percent said they suffered a data breach.

 

Weak Links in Security Increasingly Lead to Supply Chain Compromises

 

Based on the responses, it’s not surprising that 75 percent of IT managers consider software exploits, unpatched vulnerabilities and/or zero-day threats as a top security risk.

 

Fifty percent consider phishing a top security risk.

 

Alarmingly, only 16 percent of IT managers consider supply chain a top security risk, exposing an additional weak spot that cybercriminals will likely add to their repertoire of attack vectors.

 

“Cybercriminals are always looking for a way into an organization, and supply chain attacks are ranking higher now on their list of methods. IT managers should prioritize supply chain as a security risk, but don’t because they consider these attacks perpetrated by nation states on high profile targets. While it is true that nation states may have created the blueprints for these attacks, once these techniques are publicized, other cybercriminals often adopt them for their ingenuity and high success rate,” said Wisniewski.

 

“Supply chain attacks are also an effective way for cybercriminals to carry out automated, active attacks, where they select a victim from a larger pool of prospects and then actively hack into that specific organization using hand-to-keyboard techniques and lateral movements to evade detection and reach their destination.”

 

Lack of Security Expertise, Budget and Up to Date Technology

According to the Sophos survey, IT managers reported that 26 percent of their team’s time is spent managing security, on average.

 

Yet, 86 percent agree security expertise could be improved and 80 percent want a stronger team in place to detect, investigate and respond to security incidents.

 

Recruiting talent is also an issue, with 79 percent saying that recruiting people with the cybersecurity skills they need is challenge.

 

Regarding budget, 66 percent said their organization’s cybersecurity budget (including people and technology) is below what it needs to be.

 

Having current technology in place is another problem, with 75 percent agreeing that staying up to date with cybersecurity technology is a challenge for their organization.

 

This lack of security expertise, budget and up to date technology indicates IT managers are struggling to respond to cyberattacks instead of proactively planning and handling what’s coming next.

 

“Staying on top of where threats are coming from takes dedicated expertise, but IT managers often have a hard time finding the right talent or don’t have a proper security system in place that allows them to respond quickly and efficiently to attacks,” said Wisniewski.

 

“If organizations can adopt a security system with products that work together to share intelligence and automatically react to threats, then IT security teams can avoid the trap of perpetually catching up after yesterday’s attack and better defend against what’s going to happen tomorrow.

 

“Having a security ‘system’ in place helps alleviate the security skills gap IT managers are facing. It’s much more time and cost effective for businesses to grow their security maturity with simple to use tools that coordinate with each other across an entire estate.”

 

Synchronized Security Solves the Impossible Puzzle of Cybersecurity

 

With cyberthreats coming from supply chain attacks, phishing emails, software exploits, vulnerabilities, insecure wireless networks, and much more, businesses need a security solution that helps them eliminate gaps and better identify previously unseen threats.

 

Sophos Synchronized Security, a single integrated system, provides this much needed visibility to threats by integrating Sophos endpoint, network, mobile, Wi-Fi, and encryption products to share information in real-time and automatically respond to incidents. More information about Synchronized Security is available at Sophos.com.

 

The Impossible Puzzle of Cybersecurity survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019.

 

This survey interviewed 3,100 IT decision makers in 12 countries and across six continents in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa. All respondents were from organizations with between 100 and 5,000 employees.

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University.

Continue Reading
Advertisement
Comments

E-Business

Facebook Agrees to Pay $5Bn in Vast Privacy Settlement

Published

on

Spread the love

Federal Trade Commission is expected to announce on Wednesday that Facebook has agreed to a sweeping settlement of allegations it mishandled user privacy and pay roughly $5bn, two people briefed on the matter said.

 

As part of the settlement, Facebook will agree to create a board committee on privacy and will agree to new executive certifications on user privacy, the people said.

 

‘The Washington Post’ reported on Tuesday that the FTC will alleged Facebook misled users about its handling of their phone numbers and its use of two-factor authentication as part of a wide-ranging complaint that accompanies a settlement ending the government’s privacy probe, citing two people familiar with the matter.

 

Two people briefed on the matter confirmed the Post report that the FTC will not require Facebook to admit guilt as part of the settlement. The settlement will need to be approved by a federal judge.

 

The FTC confirmed in March 2018 it had opened an investigation into allegations Facebook inappropriately shared information belonging to 87 million users with the now-defunct British political consulting firm Cambridge Analytica. The inquiry has focused on whether the data-sharing violated a 2011 consent agreement between Facebook and the regulator and then widened to include other privacy allegations, reports The Guardian.

 

A person briefed on the matter said neither the phone number nor two-factor authentication issues were part of the initial Cambridge Analytica investigation.

 

Continue Reading

E-Business

How, Why Mobile Wallets Can Deepen Financial Inclusion

Published

on

Spread the love

Access to financial services opens doors for families, allowing them to smooth out consumption and invest in their futures through education and health.

 

Access to credit enables businesses to expand, creating jobs and reducing inequality.

 

Unfortunately, in Nigeria, financial Inclusion is a serious challenge as Enhancing Financial Innovation & Access (EFInA), a financial sector development organization that promotes financial inclusion in Nigeria recently said that 60.1 million Nigerians are currently financially excluded.

 

That is why the Central Bank of Nigeria’s (CBN) recently authorized commercial banks to commence full operation of mobile money wallets.

 

The move is expected to deepen financial inclusion in Nigeria and maintain the CBN’s commitment to actualise 80% of the target by 2020.

 

Sam Okojere and Ahmad Abdullahi, directors of Payments System Management Department and Banking Supervision Department respectively of the CBN, said, that the aim of the initiative is basically to complement growth in agent banking services under the Super Agent and the Shared Agent Network Expansion Facility (SANEF) initiative.

 

They also, said that the initiative is also being implemented in recognition of the increasing demand for no-frills mobile money services.

 

Mobile payment (also referred to as mobile money, mobile money transfer, and mobile wallet) generally refer to payment services operated under financial regulation and performed from or via a mobile device, that is mobile phone.

 

Mobile payment works in just three simple steps; To send or receive money to a friend: (1) Register with a money transfer service by setting up an account and making a deposit.

 

(2) Use the provided short text commands to text cash to your friend’s phone number or account id; and to (3) Receive funds by requesting and accepting payments via text message.

 

Though there are inherent dangers of mobile banking, including the risk of getting fake SMS messages and scams, the benefits are far greater.

 

For instance, there is the ability to access funds anywhere, anytime saves time, improves security and provides a means for saving and managing money more effectively than traditional methods.

 

But it also creates an effect that drives broader economic growth.

 

 

Continue Reading

E-Business

Experts Urge Implementation of National Cyber Security Policy & Strategy

Published

on

Spread the love

Worried by absence of coordinated approach in the fight against cybercrimes, information and communications technology experts hare seeking the revival of National Cyber security Policy and Strategy document.

 

Speaking at Telecom Executives and Regulators Forum, organised by Association of Telecommunications Companies of Nigeria (ATCON), Mohammed Rudman, president, Nigeria Internet Registration Association (NiRA), said the National Cyber security Policy and Strategy is supposed to be the highest document for Nigeria when it comes to cyber security.” It was supposed to be constantly reviewed so that certain frameworks of cyber security will always be added and implemented as security should be constantly reviewed for effectiveness.

 

“It was implemented in February 2015 during federal executive council meeting when they wanted to change the timing of election of 2015, at that time President Jonathan approved that document. Since that time, I have not heard anything from the Office of National Security Adviser regarding that document. That document is the most critical document among all the cyber security documents coming out from NCC and NITDA; they are supposed to be all coordinated to have a national strategy to know where we are going.

 

“The Office of National Security Adviser needs to do more because Computer Emergence Response Team (CERT) is actually an output of that regulation. CERT that is supposed to handle and monitor activities of Nigerians, detect and respond to issues of cyber security derives its power from that document and nothing is been done much,” he noted.

 

Engr. Ike Nnamani, president, Demadiur Systems, publishers of Nigeria Cyber Security report, corroborating Rudman said that National Cyber security Policy and Strategy is a guideline for different organisations to secure their infrastructure against cyber attacks and how they can collaborate as well as report incidences of cybercrimes.

 

“As at today, I don’t know anything about this document after it was approved. What has happened with the absence of its implementation is that organisations and institutions’ cyber security efforts as well as policies are in silos without coordination and collaboration,” he added.

 

On sovereignty of data, Rudman said: “we need to be ambitious in terms of localising our data. The target of NITDA to achieve 30 per cent local cloud adoption in five years is small. I have been an advocate of localising data and traffic in Nigeria for the last 12 years.

 

“I have been pushing that as a country with huge population we can position Nigeria as a hub for internet content in Africa, right now South Africa for example has 70 per cent of their websites registered and hosted in South Africa, while 80 per cent of their internet traffic are localised within South Africa and IP resources they are consuming is 26 per cent.

 

“IP resources Nigeria is consuming is only 3 per cent while we are number seven in the world in the use of internet and people doing this are aware; the telecoms doing Network Address Translation, using private IP addresses.

 

“We need to find ways to be honest to ourselves, find ways within the industry to collaborate while pushing the cloud. If we don’t have a localised cloud services, how can you regulate what you don’t have on ground?

 

“The data centres we are using is somewhere in the world which you don’t know where it is, in fact some of the data centres are hidden, they are in black market. How do you regulate that?

 

“We have the infrastructure on ground with international certified data centres with tier IV, what we need is determination to ensure compliance to directive for our data to be hosted in the country.

 

The biggest government agencies in Nigeria are not hosting their data in the country. You can’t be talking about data sovereignty when almost all your data is outside of the country,” he said.

 

 

 

Continue Reading

Trending

Copyright © 2017 Communication Week Media Limited.