While most execs agree cyber attacks are increasing, they are confused about what threats pose the most risk and lack the means to defend against them. That is according to a study for SolarWinds MSP, the IT service management company for managed service providers. With the Ponemon Institute, it asked 202 senior-level security executives in the US and UK about emerging security threats. Specifically, the study addressed those propagated by the “Vault 7” leaks, and the more WannaCry and Petya ransomware attacks.
Most respondents did not think their organisation had the budget or technology to deal with cybersecurity threats.
A minority, 45pc said that they had the technology to prevent, detect, and contain cybersecurity threats, while only 47pc felt that they had enough budget to cope. While a majority (69pc) of respondents had a high awareness of both WannaCry and Petya threats, they were far less aware of the potential of Vault 7 threats, with the highest level of awareness at 30pc.
The number of attacks that businesses had detected was potentially even more worrying than the confusion over risk, the study found. A majority (54pc) of security executives admitted that their business had experienced an attack in the last year. Of those, almost half (47pc) had been unable to prevent the attack. The result of attacks included theft of data assets (52pc), the disruption to business process (47pc), and IT downtime (41pc).
Businesses do not feel prepared to prevent attacks. Near three in ten, 29pc said that they would be unable to prevent a Petya attack and 28pc would be unable to prevent a WannaCry attack. Businesses are even less prepared for Vault 7 exploit attacks, with only 9pc ready to prevent exploits of Vault 7 threats like Dark Matter or After Midnight. As for remediation, 44pc of respondents who were aware of the WannaCry patch didn’t implement it; and a majority, 55pc didn’t patch for Petya.
Larry Ponemon, Founder, Ponemon Institute, said: “The lack of knowledge among senior-level security executives is worrying—they know that attacks are on the increase, but many don’t know what they are and seem unable to effectively prevent them. Better use needs to be made of the resources available, such as US CERT alerts, and the service providers that most businesses are using to outsource protection. Those providers also need to step up and provide education on where most attacks are coming from and how they can be prevented.”
And Tim Brown, VP of security architecture, SolarWinds MSP, said: “There is a role for managed service providers (MSPs) to play based on this research, by supporting companies as they navigate the ever-evolving security threats businesses face. It’s a bit like the wild west now, as we saw from the widespread fallout from WannaCry and Petya, and may still see from Vault 7 if those leaks are more widely exploited. Indeed, we have no crystal ball to know what threats lie on the horizon. Businesses need help with everything from awareness to technology to specialised staff. This study supports a view that MSPs have a unique opportunity to expand their security offerings to meet this need by filling gaps that can’t be easily filled in house.”
