Many of the cyber attacks that businesses have to deal with are becoming more sophisticated, but a large number still use tried and tested methods that, in some cases, have been relied on for decades.
This is according to the findings of Verizon's 2015 Data Breach Investigations Report, which revealed that techniques such as phishing and hacking still have a major role to play in many incidents. Indeed, the majority of cyber attacks analysed by the report (70 per cent) used a combination of these tactics.
Overall, 96 per cent of incidents studied by Verizon could be classed as belonging to one of nine basic attack patterns. These were:
- Miscellaneous errors (ie sending an email to the wrong person)
- Crimeware (malware aimed at gaining control of systems)
- Insider/privilege misuse
- Physical theft/loss
- Web app attacks
- Denial-of-service attacks
- Point-of-sale intrusions
- Payment card skimmers
Which of these techniques are most common vary from industry to industry, but Verizon stated that for any given sector, 83 per cent of security incidents will involve one of the top three threat patterns - up from 76 per cent last year.
Understanding which of these tactics are most common for firms in their sector can therefore help enterprises to effectively prioritise their security efforts and establish a more focused and effective approach to fighting cyber threats, the report said.
Verizon's study also highlighted that many firms are still not doing enough to protect themselves from attacks. For instance, it highlighted that many businesses suffer from a major 'detection deficit' - the time between a breach occurring and the company discovering it.
In 60 per cent of incidents, attackers are able to compromise an organisation within a matter of minutes, so closing this gap should be a key priority for enterprises.
The report warned that the longer it takes for an organisation to discover a breach, the more damage can be done. In more than a quarter of cases, it takes an organisation weeks or even months to detect and contain a security incident.
Another potential problem area is that businesses are failing to react to known vulnerabilities by implementing vital security patches, which can leave them open to attacks. In some cases, businesses were found to still have vulnerabilities that have been known about since 2007.
Mike Denning, vice-president of global security for Verizon Enterprise Solutions, said the report shows there remain "sizeable gaps" in the solutions companies deploy to defend themselves.
"While there is no guarantee against being breached, organisations can greatly manage their risk by becoming more vigilant in covering their bases. This continues to be a main theme, based on more than ten years of data from our 'Data Breach Investigations Report' series," he continued.
Enterprises must therefore take action to improve their performance in this area. To achieve this, Verizon made seven key recommendations for businesses to consider when evaluating their solutions. These were:
- Improve vigilance
- Make people your first line of defence
- Only keep data on a need-to-know basis
- Patch promptly
- Encrypt sensitive data
- Use two-factor authentication
- Don’t forget physical security
To make a business as secure as possible, effective software tools will be required. Innovations from Encode, supported by IBM QRadar, can give businesses all the technology tools they need, providing peace of mind that their business is protected.