Less Than a Quarter of Businesses Are Ready To Resist A Cyberattack

On average, only 23% of organizations are capable of responding effectively to a cyber-incident. This is especially bad for companies in the retail and hospitality sectors, which were the top-attacked verticals in 2015.

That’s the word from NTT Group’s annual Global Threat Intelligence Report, which found that not only do 77% have no capability to respond to critical incidents, but that the addressable fixable issues of social engineering and exploits of old vulnerabilities continue to be popular attack vectors.

In fact, spear phishing attacks accounted for approximately 17% of incident response activities supported in 2015. In many cases, the attacks targeted executives and finance personnel with the intent of tricking them into paying fraudulent invoices.

The bad guys are putting more effort into social engineering too. Activity related to the reconnaissance phase of the Lockheed Martin Cyber Kill Chain (CKC) accounted for nearly 89% of all log volume. These logs accounted for approximately 35% of escalated attack activity, making reconnaissance the largest single element in the CKC.

The report also found that all of the top 10 vulnerabilities targeted by exploit kits during 2015 are related to Adobe Flash. In 2013, the top 10 vulnerabilities targeted by exploit kits included one Flash and eight Java vulnerabilities. That has changed as new Java vulnerabilities have dropped steadily since 2013. The number of publicized Flash vulnerabilities jumped by almost 312% over 2014 levels.

But here’s the kicker: Nearly 21% of vulnerabilities detected in client networks were more than three years old. Results included vulnerabilities from as far back as 1999, making them more than 16 years old.

The retail sector meanwhile experienced the most attacks per client, according to the report, at just fewer than 11%—nearly three times as many attacks as clients in the finance sector. Retailers often process large volumes of personal information—including credit card data—in highly distributed environments with many endpoints and point of service devices. Such diverse environments can be difficult to protect, the report noted.

The hospitality sector faces many of the same challenges as the retail sector, also processing high volumes of sensitive information including credit card data. Transactions in the hospitality sector, that includes hotels and resorts, tend to be sizable, that can make compromising those card numbers more attractive to attackers.

The hospitality sector also includes a significant number of loyalty plans that house even more personal information then insurance, government and manufacturing. While the finance sector showed the highest volume of attacks overall, on a per-client basis, retail clients experienced 2.7 times the number of attacks as finance.

The insurance and government sectors both ranked in the top five most attacked sectors in 2015, and manufacturing continued to detect significant attacks, consistent with levels experienced in previous years. Overall, clients in the top five sectors experienced more than 44% of the attacks observed by NTT Group during 2015.

The report also found that there’s been an 18% rise in malware detected for every industry other than education.

One bright spot: DoS/DDoS attack volume fell 39% from levels observed in 2014. Implementation of better mitigation tools, along with fewer attacks, combined for a drop in detections of denial of service (DoS) and distributed denial of service (DDoS) activities. But, extortion based on the victim’s paying to avoid or stop DDoS attacks became more prevalent.

Infosecurity: http://bit.ly/1WHRTWS

« NSA Has ‘No Idea’ How Many American Citizens It’s Spying On
12% Of Bank CEOs Don’t Even Know If They’ve Been Hacked »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Securezoo

Securezoo

Securezoo's mission is to simplify and enhance information security by providing trusted security guidance, products, and information to small and mid-sized businesses and security professionals.

Black Duck Software

Black Duck Software

Black Duck Hub allows organizations to manage open source code security as well as license compliance risks.

Prevalent

Prevalent

Prevalent takes the pain out of third-party risk management. Companies use our services to eliminate the security and compliance exposures that come from working with vendors and suppliers.

CICRA

CICRA

CICRA is Sri Lanka's pioneering cyber security training and consultancy provider.

Malleum

Malleum

MALLEUM are specialists in penetration testing and security assessments. We think like hackers – and act like them – to disclose discreet dangers to your organization.

Connectria

Connectria

Connectria provides cloud hosting, remote monitoring, and compliant cloud security solutions and services to enterprises, medium and small businesses.

Secured Communications

Secured Communications

Secured Communications has developed the only unified secure communications platform trusted by public safety and counter terrorism professionals around the world.

Research Institute in Secure Hardware and Embedded Systems (RISE)

Research Institute in Secure Hardware and Embedded Systems (RISE)

The UK Research Institute in Secure Hardware and Embedded Systems (RISE) seeks to identify and address key issues that underpin our understanding of Hardware Security.

ESC - Enterprise Security Center

ESC - Enterprise Security Center

ESC is a system house specializing exclusively in IT security - Security Implementation & Optimization, Operations, Managed Security Services.

SolidRun

SolidRun

SolidRun is a leading provider of computing and network technology designed to streamline the deployment of edge computing infrastructure and support embedded and IoT markets.

Zokyo

Zokyo

Zokyo is a venture studio that builds, secures, and funds legendary web3/crypto businesses.

KATIM

KATIM

KATIM is a leader in the development of innovative secure communication products and solutions for governments and businesses.

Klaatu IT Security (KITS)

Klaatu IT Security (KITS)

Klaatu IT Security is a boutique provider of cyber security services, empowering our clients to prioritise and reduce their cyber risk.

Data Defenders

Data Defenders

Data Defenders provide information security technology solutions that empower consumers, businesses and governments with safe and secure IT and cybersecurity infrastructures.

ABPSecurite

ABPSecurite

ABPSecurite is a leading value-added distributor and a network performance solutions provider.