Cyberattacks Longer, More Continuous Than Before

Companies hit with cyberattacks this year spent a longer time on average mitigating the threat than at any time previously, highlighting the growing sophistication and complexity of the threat landscape.

Some 19% of 340 technology executives surveyed by security vendor Radware Inc. earlier this year described attacks against their companies as “constant,” with about 15% saying the attacks lasted more than one month.

This marks the first time in the four years that Radware has done the survey where so many respondents reported experiencing month-long attacks. “This trend challenges the traditional concept of incident response, which assumes a normal state without attacks,” Radware said in its “Global Application & Network Security Report.”

Enterprises appeared more or less equally worried about a wide range of security threats, including phishing, fraud, IP theft, and worm and virus damage. Somewhat surprisingly though, distributed denial of service attacks (DDoS) topped the list of threats that IT managers were most concerned about this year, followed by advanced persistent threats, according to the Radware survey.

Concerns about the ability of companies to defend against cyberthreats are running high as the result of a seemingly never-ending string of high-profile data breaches this year.

The massive -- and still unfolding -- intrusion at Sony Pictures has capped what has been one of the worst-ever years for data breaches in recent memory. Since the breach at Target last year that exposed data on some 40 million credit and debit cards, others that have disclosed major network compromises include Home Depot, JPMorgan Chase, Supervalu, UPS Stores Inc., and Dairy Queen. In almost all these incidents, the intruders managed to remain undetected for weeks, and sometimes even months after gaining initial access into company networks.

“2014 was a watershed year for the security industry,” Radware noted. “Cyber-attacks reached a tipping point in terms of quantity, length, complexity and targets.”

Radware’s survey and those by others in recent weeks show that companies have become more aware of the risks they face and are moving to address them. Even so, some troubling gaps remain.

Radware, for instance, found that less than half the companies surveyed were equipped to fight off cyberattacks for any sustained period of time. In fact, 52% said they would be able to fight off a sustained attack on their network for a day at most. Nearly 50% of those surveyed identified reputation loss as their biggest concern, followed by revenue loss, and then service disruptions.

Another survey conducted by the Ponemon Institute on behalf of Experian showed that, while many companies have made some positive changes on the security front, their governance and overall data-breach preparedness continue to lag. Companies continued to have trouble in areas like data-breach response, risk assessments, network anomaly detection, and continuous network monitoring.

For instance, about 73% of the 567 IT executives surveyed by Ponemon said their companies had implemented a data-breach response plan. However, only about 30% felt the plan was “effective” or “very effective” while 30% felt exactly the opposite way.

Among the issues identified as hindering their breach response were a lack of visibility into end-user access to critical data and systems, the continuing proliferation of mobile devices and cloud services, and third-party access to corporate data.

Somewhat encouragingly, though, companies appear to be willing to invest more in shoring up security. The Radware survey showed that, while many companies still have a hard time figuring out how much they need to spend on security, nearly half said they had invested in new or specialized technologies to deal with cyberthreats. At many companies, security has become a CEO and board-level issue.

“Research confirms that the motives, means and effectiveness of security attacks are on the rise,” Radware said in its report. “[The trend] highlights the need for greater agility to quickly adapt to evolving threats.”