sb-nz logo
Story image

Businesses too slow on attack detection – CrowdStrike

13 Dec 2018

Endpoint protection provider CrowdStrike has announced the release of the 2018 CrowdStrike Services Cyber Intrusion Casebook, which provides insights into the frontlines of incident response (IR) cases spanning 2018.

It offers recommendations for organisations looking to safeguard critical data and improve overall breach preparedness, detection and response capabilities.

The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 notable cyber intrusion cases, spanning a multitude of industries, that CrowdStrike Services engaged on during the past year. The Casebook provides a look at distinct IR use cases to offer trends in adversary behaviour, motivation, and tactics, as well as response scenarios. It provides an investigative analysis of specific cases, dives into forensic artefacts uncovered in multiple instances referencing the MITRE ATT&CK framework, and offers best practices for organisations looking to improve cyber defences.

Some key findings include:

  • Organisations are not making substantive progress to detect intruders and stop breaches overall. This year, 75% of the organisations CrowdStrike engaged with were able to internally detect a breach. This represents merely a seven percent increase over the prior year’s findings, indicating that organisations have only slightly improved their ability to detect breaches. Dwell time also remained relatively the same at an average of 85 days compared to 86 in 2017. This statistic reflects the number of days between the first evidence of a compromise and its initial detection.  
  • Commodity malware was often observed as a precursor to larger, more disruptive attacks. An organisation’s susceptibility to commodity malware is also an indicator of the effectiveness of their entire security strategy: If their systems can be compromised with commodity malware, then what could a more sophisticated attacker do?  
  • There was a rise in the number of attacks that leveraged social engineering and phishing. Across the IR cases observed, the CrowdStrike team observed a dramatic increase in the number of attacks leveraging social engineering, phishing and spear-phishing, jumping from 11% in 2017 to 33% in 2018. This accounted for one-third of all attacks investigated by CrowdStrike Services. Web server attacks comprised the biggest single attack vector, but showed a decline from the 37% noted last year to 19.7%.

CrowdStrike Services chief security officer and president Shawn Henry says, “Cyber-related attacks continue to proliferate as eCrime actors and nation-states ramp up their sophistication.

“It’s absolutely critical that today’s businesses are aware of emerging attack trends and adversary motivations in order to implement a more proactive stance to cybersecurity.”

“It is not a question of if you will be targeted, because it will happen to everyone. This is a business risk, and Boards of Directors and the C-Suite need to have a sense of urgency to protect their organisations’ viability.

“The CrowdStrike Services Casebook contains indispensable content that provides valuable insights into proactively preparing for security incidents and responding efficiently in the wake of an attack.”

The 2018 Casebook offers guidance on remaining protected against today’s ever-evolving threat landscape, including integrating next-generation endpoint security and proactive strategies to increase cyber resiliency.

Tools such as machine learning and behavioural analytics help prevent exploits and never-before-seen threats, while proactive threat hunting can help uncover even the most stealthy adversary.

Additionally, solutions that provide for efficient remediation capabilities can aid in mitigating the threat before a small infection or compromise turns into something larger and more costly to the organisation.

Story image
Revealed: The behaviours exhibited by the most effective CISOs
As cyber-threats pile up, more is being asked of CISOs - and according to Gartner, only a precious few are 'excelling' by the standards of their CISO Effectiveness Index.More
Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Story image
Is cyber deception the latest SOC 'game changer'?
Cyber deception reduces data breach costs by more than 51% and Security Operations Centre (SOC) inefficiencies by 32%, according to a new research report by Attivo Networks and Kevin Fiscus of Deceptive Defense.More
Story image
ConnectWise launches bug bounty program to bolster cybersecurity strategy
“Crowdsourcing in this way represents a solid additional layer of security, and we clearly value the community's expertise and participation in helping us keep our products secure."More
Story image
Video: 10 Minute IT Jams - The benefits of converged cloud security
Today, Techday speaks to Forcepoint senior sales engineer and solutions architect Matthew Bant, who discusses the benefits of a converged cloud security model, and the pandemic's role in complicating the security stack in organisations around the world.More
Story image
Video: 10 Minute IT Jams - Who is Bitglass?
Today, Techday speaks to Bitglass senior director of marketing Jonathan Andresen, who discusses insider attacks and the best solutions and practices to employ to protect organisations and employees.More