EU firms slow in detecting cyber attacks, study shows

European firms take three times longer on average than the rest of the world to find cyber attackers in their systems, a report has revealed.

The average time to make a discovery in the past year was 469 days after the initial compromise, versus an average of 146 days globally, according to the latest M-Trends report by Mandiant, a FireEye company.

The report, based on investigations by Mandiant in the past year, reveals that attackers are able to steal an average of 2.6GB, potentially down to the fact they are able to infiltrate the network for so long, said the first M-Trends report for Europe, Middle-East and Africa.

According to Mandiant, the global average dwell time of 146 days – between compromise and detection – is influenced by data from the US, where the security maturity baseline is higher and proactive threat hunting is slowly becoming common in security operations centres (Socs) for advanced investigations.

“This region is still very much in the infancy of proactively hunting for cyber criminals in networks,” said Bill Hau, vice-president of Mandiant.

“Apart from a few leading-edge organisations, most are on the defensive architecture, tending to wait until they are attacked before taking action, while they need a more proactive approach to find malicious actors hiding in organisations’ IT environments,” he told Computer Weekly.

Organisations should aim to be able to find any attackers operating in their networks, said Hau, or at the very least know that they have been breached and what data the attackers have compromised.

The report notes that an average of 15 months’ dwell time provides ample time for any attacker to progress through the full attack lifecycle and achieve multiple goals within their mission objectives. 

To put this into perspective, the report said Mandiant’s Red Team, on average, is able to obtain access to domain administrator credentials within three days of gaining initial access to an environment.

“Therefore, once domain administrator credentials are stolen, it is only a matter of time before an attacker is able to locate and gain access to the desired information,” the report said.  

From a forensic investigation point of view, investigators must hunt for threat actors posing as an insider, the report said.

Mandiant observed that an attacker used an average of 37 user accounts and seven administrator-level accounts during a compromise.

“Determining which compromised credentials were utilised during any one attack is crucial to pulling the pieces of the puzzle together,” the report said.

According to the report, the findings show that existing security controls in organisations in the region are not up to the challenge of stopping or consistently detecting advanced threat actors.