IT managers are more likely to catch cybercriminals on their organisation’s servers and networks than anywhere else, reveals a recently conducted survey. Sophos, a global leader in network and endpoint security, today announced the findings of its global survey, 7 Uncomfortable Truths of Endpoint Security, which reveal the extent to which Indian businesses are at risk of repeated cyber attacks and are vulnerable to exploits.
In fact, IT managers discovered 39 per cent of the most significant cyber attacks on their organisation’s servers and 34.5 per cent on its networks. Only 7.9 per cent were discovered on endpoints and 18.8 per cent, which is almost double the global average, were found on mobile devices. The survey polled more than 3,100 IT decision makers from mid-sized businesses in 12 countries including the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.
IT security continues to be a major issue across the globe with 68 per cent of organisations surveyed hit by cyber attacks in the last year (76.3 per cent organisations in India). On average, organisations impacted by cyber attacks were struck at least twice.
“Server security stakes are at an all-time high with servers being used to store financial, employee, proprietary, and other sensitive data. Today, IT managers need to focus on protecting business-critical servers to stop cybercriminals from getting on to the network. They can’t ignore endpoints because most cyber attacks start there, yet a higher than expected amount of IT managers still can’t identify how threats are getting into the system and when.” said Sunil Sharma, managing director sales at Sophos India & SAARC.
Fourteen per cent of IT managers who were victim to one or more cyber attacks last year can’t pinpoint how the attackers gained entry, and 17 per cent don’t know how long the threat was in the environment before it was detected, according to the survey. To improve this lack of visibility, IT managers need endpoint detection and response (EDR) technology that exposes threat starting points and the digital footprints of attackers moving laterally through a network.
Key India-specific survey findings:
- Most cybercriminals are detected at the server (39 percent) or on the network (35 percent); 8 percent are found on endpoints
- More than 18 per cent threats discovered in India are on mobile devices, almost double than the global average
- 92 per cent Indian IT managers wish they had a stronger team in place to properly detect, investigate and respond to security incidents
- 89 per cent IT managers surveyed believe cybersecurity recruitment is a challenge
- 97 per cent IT managers admitted that security expertise is one of the greatest issues in India
- Three – fourths of Indian organisations admitted not being able to take full advantage of implemented EDR solutions
- 67 per cent Indian organisations plan to add Endpoint Detection and Response (EDR) capabilities to fight cyber attacks
- After Mexico and France, Indian businesses most hit by cyber attacks
“IT managers who are unaware about the origins or movements of an attack, will not be able to minimise risk and interrupt the attack chain to prevent further infiltration,” said Sharma. “EDR helps them identify the risks and put a process in place for organisations at both ends of the security maturity model. If IT focuses on threat detection, EDR which is an integral piece that provides threat intelligence can quickly find, block and remediate these threats.”
On average, Indian organisations that investigate one or more potential security incidents each month spend 48 days a year (four days a month) investigating them, according to the survey. It comes as no surprise that IT managers ranked identification of suspicious events (22 per cent), alert management (19 per cent) and prioritisation of suspicious events (13 per cent) as the top three features they need from EDR solutions to reduce the time taken to identify and respond to security alerts.
“Most spray and pray cyberattacks can be stopped within seconds at the endpoints without causing alarm. Persistent attackers, including those executing targeted ransomware like SamSam, take the time they need to breach a system by finding poorly chosen, guessable passwords on remotely accessible systems (RDP, VNC, VPN, etc), establish a foothold and quietly move around until the damage is done,” said Wisniewski. “If IT managers have defense-in-depth with EDR, they can also investigate an incident more quickly and use the resulting threat intelligence to help find the same infection across an estate. Once cybercriminals know certain types of attacks work, they typically replicate them within organisations. Uncovering and blocking attack patterns would help reduce the number of days IT managers spend investigating potential incidents.”
Sixty-seven per cent of respondents said they were planning to implement an EDR solution within the next 12 months. Having EDR also helps address a skills gap. Eighty per cent of IT managers wish they had a stronger team in place, according to the survey. More information is available in the 7 Uncomfortable Truths of Endpoint Security PDF and on Sophos News.
The 7 Uncomfortable Truths of Endpoint Security survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019. This survey interviewed 3,100 IT decision makers in 12 countries and across six continents including India. All respondents were from organisations with between 100 and 5,000 employees.