{"id":36033,"date":"2019-08-01T12:14:56","date_gmt":"2019-08-01T04:14:56","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=36033"},"modified":"2019-08-01T12:14:58","modified_gmt":"2019-08-01T04:14:58","slug":"weak-links-in-security-lead-to-supply-chain-compromises-sophos-global-survey","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2019\/08\/01\/weak-links-in-security-lead-to-supply-chain-compromises-sophos-global-survey\/","title":{"rendered":"Weak links in security lead to supply chain compromises \u2013 Sophos global survey"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Sophos announced the findings of its global survey, The Impossible Puzzle of Cybersecurity, which reveals only 16 percent of IT managers consider supply chain a top security risk, exposing an additional weak spot that cybercriminals will likely add to their repertoire of attack vectors. The survey polled 3,100 IT decision makers from mid-sized businesses in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cCybercriminals are always\nlooking for a way into an organization, and supply chain attacks are ranking\nhigher now on their list of methods. IT managers should prioritize supply chain\nas a security risk, but don\u2019t because they consider these attacks perpetrated\nby nation states on high profile targets. While it is true that nation states\nmay have created the blueprints for these attacks, once these techniques are\npublicized, other cybercriminals often adopt them for their ingenuity and high\nsuccess rate,\u201d said Wisniewski. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cSupply chain attacks are also an effective way for cybercriminals to\ncarry out automated, active attacks, where they select a victim from a larger\npool of prospects and then actively hack into that specific organization using\nhand-to-keyboard techniques and lateral movements to evade detection and reach\ntheir destination.\u201d <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cybercriminals Use Multiple Attack\nMethods and Payloads for Maximum Impact<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;The Sophos survey shows how attack techniques are varied and often multi-staged, increasing the\ndifficulty to defend networks. One in five IT managers surveyed didn\u2019t know how\nthey were breached, and the diversity of attack methods means no one defensive\nstrategy is a silver bullet. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cCybercriminals\nare evolving their attack methods and often use multiple payloads to maximize\nprofits. Software exploits were the initial point of entry in 23 percent of\nincidents, but they were also used in some fashion in 35 percent of all attacks, demonstrating how exploits are used at multiple stages of the\nattack chain,\u201d said Chester Wisniewski, principal research scientist, Sophos. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cOrganizations\nthat are only patching externally facing high-risk servers are left vulnerable\ninternally and cybercriminals are taking advantage of this and other security\nlapses.\u201d <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The wide range,\nmultiple stages and scale of today\u2019s attacks are proving effective. For\nexample, 53 percent of those who fell victim to a cyberattack were hit by a phishing\nemail, and 30 percent by ransomware. Forty-one percent said they suffered a\ndata breach. <strong><br>\n<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Key\nSurvey Findings:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Only 16 percent consider supply chain\na top security risk, exposing an additional weak spot<ul><li>Nation\nstate adversaries have proven how successful supply chain attacks are, which\nmeans common cybercriminals are likely to adopt the attack method<strong><\/strong><\/li><\/ul><ul><li>Supply chain\nattacks are a launch pad to emerging automated, active-adversary attacks<strong><\/strong><\/li><\/ul><\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>Cybercriminal tactics have evolved into using multiple attack\nmethods and often multiple payloads to maximize profits<ul><li>Software exploits were the\ninitial cause of 23 percent of incidents and used in 35 percent of cyberattacks,\ndemonstrating how exploits are used at multiple stages of the attack chain<\/li><\/ul><ul><li>Phishing emails impacted 53\npercent of those hit by a cyberattack<\/li><\/ul><ul><li>Ransomware impacted 30\npercent of attack victims<\/li><\/ul><ul><li>41 percent of attack\nvictims suffered a data breach<\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Synchronized Security Solves the Impossible Puzzle of\nCybersecurity<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With cyber threats coming from supply chain attacks, phishing emails, software exploits, vulnerabilities, insecure wireless networks, and much more, businesses need a security solution that helps them eliminate gaps and better identify previously unseen threats. Sophos Synchronized Security, a single integrated system, provides this much needed visibility to threats by integrating Sophos endpoint, network, mobile, Wi-Fi, and encryption products to share information in real-time and automatically respond to incidents.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Impossible Puzzle of Cybersecurity survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019. This survey interviewed 3,100 IT decision makers in 12 countries and across six continents in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa. All respondents were from organizations with between 100 and 5,000 employees.  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cybercriminals are always looking for a way into an organization, and supply chain attacks are ranking higher now on their list of methods. IT managers should prioritize supply chain as a security risk, but don\u2019t because they consider these attacks perpetrated by nation states on high profile targets.<\/p>\n","protected":false},"author":6,"featured_media":33149,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,18],"tags":[54,206],"class_list":["post-36033","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-white-papers","tag-security","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/36033","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=36033"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/36033\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/33149"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=36033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=36033"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=36033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}