Sophos announced the findings of its global survey, The Impossible Puzzle of Cybersecurity, which reveals only 16 percent of IT managers consider supply chain a top security risk, exposing an additional weak spot that cybercriminals will likely add to their repertoire of attack vectors. The survey polled 3,100 IT decision makers from mid-sized businesses in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.
“Cybercriminals are always looking for a way into an organization, and supply chain attacks are ranking higher now on their list of methods. IT managers should prioritize supply chain as a security risk, but don’t because they consider these attacks perpetrated by nation states on high profile targets. While it is true that nation states may have created the blueprints for these attacks, once these techniques are publicized, other cybercriminals often adopt them for their ingenuity and high success rate,” said Wisniewski.
“Supply chain attacks are also an effective way for cybercriminals to carry out automated, active attacks, where they select a victim from a larger pool of prospects and then actively hack into that specific organization using hand-to-keyboard techniques and lateral movements to evade detection and reach their destination.”
Cybercriminals Use Multiple Attack Methods and Payloads for Maximum Impact
The Sophos survey shows how attack techniques are varied and often multi-staged, increasing the difficulty to defend networks. One in five IT managers surveyed didn’t know how they were breached, and the diversity of attack methods means no one defensive strategy is a silver bullet.
“Cybercriminals are evolving their attack methods and often use multiple payloads to maximize profits. Software exploits were the initial point of entry in 23 percent of incidents, but they were also used in some fashion in 35 percent of all attacks, demonstrating how exploits are used at multiple stages of the attack chain,” said Chester Wisniewski, principal research scientist, Sophos.
“Organizations that are only patching externally facing high-risk servers are left vulnerable internally and cybercriminals are taking advantage of this and other security lapses.”
The wide range,
multiple stages and scale of today’s attacks are proving effective. For
example, 53 percent of those who fell victim to a cyberattack were hit by a phishing
email, and 30 percent by ransomware. Forty-one percent said they suffered a
data breach.
Key Survey Findings:
- Only 16 percent consider supply chain
a top security risk, exposing an additional weak spot
- Nation state adversaries have proven how successful supply chain attacks are, which means common cybercriminals are likely to adopt the attack method
- Supply chain attacks are a launch pad to emerging automated, active-adversary attacks
- Cybercriminal tactics have evolved into using multiple attack
methods and often multiple payloads to maximize profits
- Software exploits were the initial cause of 23 percent of incidents and used in 35 percent of cyberattacks, demonstrating how exploits are used at multiple stages of the attack chain
- Phishing emails impacted 53 percent of those hit by a cyberattack
- Ransomware impacted 30 percent of attack victims
- 41 percent of attack victims suffered a data breach
Synchronized Security Solves the Impossible Puzzle of Cybersecurity
With cyber threats coming from supply chain attacks, phishing emails, software exploits, vulnerabilities, insecure wireless networks, and much more, businesses need a security solution that helps them eliminate gaps and better identify previously unseen threats. Sophos Synchronized Security, a single integrated system, provides this much needed visibility to threats by integrating Sophos endpoint, network, mobile, Wi-Fi, and encryption products to share information in real-time and automatically respond to incidents.
The Impossible Puzzle of Cybersecurity survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019. This survey interviewed 3,100 IT decision makers in 12 countries and across six continents in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa. All respondents were from organizations with between 100 and 5,000 employees.
