lolloj - Fotolia

UK firms struggling to manage cyber threats, survey shows

Businesses want security suppliers to offer more complementary products and collaborate more effectively as they struggle to manage data protection in the light of new laws, a survey shows

UK business are struggling to detect, prevent and respond to cyber threats, a survey of 2,000 IT professionals from companies of various sizes across 14 industry sectors has revealed.

While 96% of respondents believe visibility into their networks is important or useful and 71% claimed to have it, 74% believe they need to improve their detection, prevention and response capabilities.

Although 80% believe their confidential data may be vulnerable to attack, only 44% said they were aware they had suffered a data breach, with 69% of them saying they had lost sensitive data as a result.

Two-thirds also admitted they are not yet prepared to comply with the European General Data Protection Regulation (GDPR) and Network and Information Security (NIS) directive that come into force in 2018.

The cyber readiness assessment survey was jointly commissioned by security intelligence and analytics firm LogRhythm, traffic visibility firm Gigamon and network security firm Forescout Technologies.

The survey was also aimed at identifying the top C-level security concerns and assessing the demand for security suppliers to take a more collaborative approach.

“While the survey shows that businesses are concerned about protecting their data and that traditional perimeter-based security is not enough, it doesn’t appear to be translating into practice,” said Ross Brewer, vice-president and managing director for Europe, Middle East and Africa (Emea) at LogRhythm.

“There’s clearly a long way to go when it comes to educating businesses on how to remain compliant as we approach the deadline for GDPR compliance,” he said, adding that experience has shown that the proportion of companies that have been breached is much higher than the 44% that admitted to it. 

Only 11% of respondents admitted that they did not know if their company had been breached, but Brewer said of the 44% that said no, many of them are probably just unaware they have been breached.

“This, together with the fact that nearly 70% of those that admitted to a breach said they found out from a third party, further underlines the need for visibility of what is going on in the company network,” he said.

Full network insight is key, says expert

According to Brewer, cyber attackers are persistent and creative, and more often than not they are able to get in, which can lead to substantial reputational damage.

“Combine this with stricter rules and harsher punishments for lax security and the impact of a successful breach is even more serious,” he said.

Brewer said having the ability to detect an attack as soon as it happens will be key to staying compliant with the new regulations.

“This can be achieved only by having full insight into networks. With fines of up to 4% of global turnover at stake, businesses simply cannot afford to take the ‘wait and see’ approach,” he said.

Myles Bray, vice-president of sales, Emea, at ForeScout, urged UK businesses to act now to reduce their security risks by having visibility of devices when they connect to the network.

“With the increasing number of traditional and internet of things [IoT] devices connecting to the network, the need for visibility is stronger than ever as bad actors are using these devices as the path of least resistance,” he said.

With malware still topping the list of security concerns for 42% of businesses, the survey revealed that more than a third now believe stolen credentials is the biggest threat to business security.

Other top security concerns included web vulnerabilities (27%), insider threats (26%), distributed denial of service attacks (26%) and social engineering attacks (25%).

Only 19% said they were concerned about ransomware attacks, despite this being the fastest growing type of cyber attack in 2016, hitting a wide range of organisations, including hospitals.

Collaborating to defeat hackers

Finally, the research revealed that there is a growing demand from businesses for security suppliers to work together.

Just more than half of respondents said their companies use more than five security suppliers, with 82% wanting security suppliers to offer more complementary – as opposed to competing – products and collaborate more effectively to fight hackers.

“Too many businesses are struggling to fight today’s ever-determined hackers, which means security suppliers need to make sure they are fighting smarter, together,” said Trevor Dearing, marketing director, Emea, at Gigamon.

“The problem for many businesses is that they don’t know where to start, subsequently picking ad-hoc systems that fail to integrate. But that integration is critical to detecting, isolating and eliminating threats before any damage has been done.

“It’s our responsibility, as leaders in our field, to join forces so that they can maximise their data and investments as much as possible. After all, the cybercriminals are increasingly pooling resources and working collaboratively – so we should do the same,” he said.

Brewer said the fact that government departments and many larger organisations are turning to system integrators and managed security service providers (MSSPs) is evidence of this market desire for a more integrated, complementary approach.

Read more about MSSPs

  • As the economic climate becomes more uncertain, many enterprises are considering the security and cost-saving benefits of managed security service providers (MSSPs).
  • Information security should be business-driven and investments assessed for their effectiveness and business value, according to Corvid CTO
  • Michael Cobb outlines the key issues for businesses to consider when examining managed security service providers.
  • Intelligence and forensics will become the most important differentiators for companies selling APT defence systems and services, says Frost & Sullivan.

Read more on Privacy and data protection