With such a lively 2016 for infosec – mega-breaches, new malware strains, inventive phishing techniques, and big debates between security and privacy – there’s plenty of reason to pause and consider what the security community should be most concerned about for 2017 and what they can do to prepare. http://www.slideshare.net/Tripwire/tripwire-survey-preparing-for-top-attacks-of-2017 Ransomware and distributed denial-of-service (DDoS) attacks certainly left their mark on 2016 (i.e. “Locky” and “Mirai”), and we can expect both to remain top concerns this year. In a new study, Tripwire analyzed the attitudes of 403 IT security professionals, looked at the key attack types expected to cause the biggest security problems in 2017, and evaluated how successfully organizations will defend against them. Here are some of the key findings:
Ransomware was ranked as the #1 concern
According to the study, Ransomware has the greatest potential to do the most amount of damage to organizations in 2017, followed by DDoS, Malicious Insiders, Phishing, and Known/Unknown Vulnerabilities.
Only three percent of organizations have the technology in place to address these concerns
When asked if they had the technology and skills to address this set of attack types, only three percent said they had the technology while only 10 percent said they had the skills.
With a clear lack of skills and technology, it’s important organizations focus on securing the most important parts of their business. According to the Center for Internet Security (CIS), organizations that apply just the first five of its CIS Controls can significantly reduce their risk of cyber attacks by approximately 85 percent.”
93% of participants said foundational security controls improve protection against new security threats.
However, only about two in three use a security standard or framework that includes a set of foundational controls. 65 percent said they lack the ability to enforce foundational controls effectively, while five percent indicated they do not have the ability at all. Even so, executives had a much higher level of confidence in this than did managers and frontline professionals.
While the community seems to be well aware of the threats that are out there, there still exists a gap in skills, technology, and processes needed to defend against them. As challenges continue to emerge, it will be imperative for security teams to leverage essential security controls against these threats.
Save
