Two Thirds Of Organisations Are Not Equipped To Deal With Cyber Threats

Web malware (47 per cent) and ransomware (42 per cent) top the list of security threats that organisations are most concerned about. Yet ,despite the growing risks, less than a third (27 per cent) have advanced threat protection in place on every endpoint device that can access corporate applications and resources. 

This is according to new research ‘The state of threat prevention: evasive threats take centre stage’, published by  cloud security specialst firm Menlo Security, who questioned 505 IT decision makers in the US and Britain in February.

The Menlo Labs research team have been analysing Highly Evasive Adaptive Threats (HEAT) which bypass traditional security defences including firewalls, Secure Web Gateways, sandbox analysis, URL Reputation, and phishing detection. The Menlo Labs team have seen a 224% increase in HEAT attacks in the second half of 2021.

Used to deliver malware or to compromise credentials, which in many cases leads to ransomware payloads, HEAT attacks include at least one of four evasion techniques:   

  • Evades Both Static and Dynamic Content Inspection 
  • Evades Malicious Link Analysis 
  • Evades Offline Categorisation and Threat Detection 
  • Evades HTTP Traffic Inspection 

As employees spend more time working in the browser and accessing cloud-based applications, the risk of HEAT attacks increases. Almost two-thirds of organisations have had a device compromised by a browser-based attack in the last 12 months. 

The report suggests that organisations are not being proactive enough in mitigating the risk of these threats, with 45 per cent failing to add strength to their network security stack over the past year. 

There are also conflicting views on the most effective place to deploy security to prevent advanced threats, with 43 per cent citing the network, and 37 per cent the cloud. “Threat actors seek to exploit gaps in traditional security defences and the fact that security capabilities haven’t really changed over the past decade.

One of the areas of focus for attackers is using web threats and we’re seeing more and more of them successfully deployed using HEAT techniques. “Last year we saw Nobelium use HTML smuggling, a HEAT tactic to avoid static and dynamic content analysis, to deliver malware and ransomware attacks. The fact that these are successful means their usage will increase, which could have devastating consequences for companies of all sizes,” explains Mark Guntrip, Director of Cybersecurity Strategy, Menlo Security.  “Working practices have changed and companies must stop relying on traditional tools and strategies that just don’t cut it anymore... Adopting a prevention-driven approach to security is the only way to achieve this and using isolation-powered security to do so stops the browser from having any direct interaction with the website and content and ensures that HEAT attacks don’t stand a chance.” Guntrip said.

Competing Security Priorities 

According to the research among 500+ IT decision makers in the UK and US, hybrid/remote working (28 per cent) is the biggest challenge organisations expect to face this year when it comes to protecting their corporate network from advanced threats. This is followed by budget restrictions (15 per cent), the presence of unmanaged devices (14 per cent), and outdated security solutions (13 per cent). 

There are also a number of competing priorities for IT professionals when it comes to improving their security posture in 2022. Training staff tops the list (61 per cent), followed by technology investment to protect the corporate network (60 per cent), adapting to new ways of working (50 per cent), and investing in skilled security members at 45 per cent. 

Additional Research Findings 

  •  Although 55 per cent of respondents have invested in their security stack over the past year and 27 per cent have advanced threat protection in place, it is not having the desired effect as attacks are still successfully penetrating their defence lines.  
  • Half of respondents believe that firewalls are an effective way of mitigating HEAT attacks and 31 per cent favour VPNs.   
  • Organisations believe that the threat of a cyber attack is a case of ‘when’ not ‘if’, regardless of size, consequently IT decision makers are most concerned about the reputational damage (62 per cent) and financial loss (57 per cent) that a security breach could have on their business.  

According to Guntrip: “Organisations need to prioritise a review of their network security solution stack. HEAT attacks target web browsers as the attack vector and employ techniques to evade detection by multiple layers in current security stacks, including firewalls, Secure Web Gateways, sandbox analysis, URL Reputation, and phishing detection, so clearly a new strategy is needed.” 

Menlo Security

You Might Also Read: 

Credentials Phishing Attacks:

 

« Georgia Must Bolster Resilience To Information Warfare
US Moves Cyber Defences To High Alert »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CyberScout

CyberScout

Cyberscout delivers the latest cybersecurity education, protection and resolutions services. We also provide swift incident response services around the world.

Innotec Security

Innotec Security

Innotec Security is a Spanish company specializing in cybersecurity-as-a-service, cyber resilience and cyber risk management.

Edvance

Edvance

Edvance operates a range of cybersecurity businesses including value added cybersecurity solutions distribution, security technology innovation and development, and SaS solution offerings.

CybernetIQ

CybernetIQ

CLAW by CybernetIQ is the industry's most advanced SOAR platform helping unify all cybersecurity tools under one umbrella and providing organizations faster, better and more accurate cybersecurity.

ARIA Cybersecurity Solutions

ARIA Cybersecurity Solutions

The ARIA ADR Automatic Detection & Response solution was designed to find, verify, and stop all types of attacks - automatically and in real time.

Digital Pathways

Digital Pathways

Digital Pathways is an award-winning data security provider that helps businesses protect their digital assets.

South West Cyber Resilience Centre (SWCRC)

South West Cyber Resilience Centre (SWCRC)

The South West Cyber Resilience Centre (SWCRC) is led by serving police officers, as part of a not-for-profit partnership with business and academia.

Bright Security

Bright Security

Bright Security is a developer-centric Dynamic Application Security Testing (DAST) solution that helps organizations ship secure applications and APIs quickly and cost-effectively.

Immunefi

Immunefi

Immunefi provides bug bounty hosting, consultation, and program management services to blockchain and smart contract projects.

Wavenet

Wavenet

Wavenet has grown from simple beginnings to become one of the UK’s market leaders in unified communications, business telephony, and Cyber Security solutions.

Supra ITS

Supra ITS

Supra ITS is a leading full-service technology partner offering IT Consulting, Cloud Services, 24x7 Managed IT & Cybersecurity Services, and IT Project Support.

TAFEcyber

TAFEcyber

TAFEcyber is an Australian based consortium focusing on the skilling of the fast-growing cyber security workforce through education and training.

SkillsDA

SkillsDA

SkillsDA is pureplay company in cyber security involved in capacity building towards National Security.

Seal Security

Seal Security

Seal Security revolutionizes software supply chain security operations, empowering organizations to automate and scale their open source vulnerability remediation and patch management.

turingpoint

turingpoint

turingpoint GmbH is a tech enabled boutique consultancy. It was founded by security experts with a focus on cyber security and software solutions.

SignalRed

SignalRed

SignalRed provides the cutting edge next-generation penetration testing and secure development solutions to startups and large enterprises.