Organizations are becoming more resilient to focused cyber attacks
Accenture has polled 4,600 security decision makers at US$1B+ companies in 15 countries to understand the effectiveness of security efforts and the adequacy of existing investments.
The survey has shown that, while the average number of focused cyberattacks per organization has more than doubled this year compared to the previous 12 months (232 vs 106), organizations are demonstrating far more success in detecting and blocking them. They are now preventing 87 percent of all focused attacks compared to 70 percent in 2017.
However, with 13 percent of focused attacks penetrating defenses, organizations are still facing an average of 30 successful security breaches per year which cause damage or result in the loss of high-value assets.
Security teams find breaches faster
It’s also taking less time to detect a security breach; from months and years to now days and weeks.
On average, 89 percent of respondents said their internal security teams detected breaches within one month compared to only 32 percent of teams last year. This year, 55 percent of organizations took one week or less to detect a breach compared to 10 percent last year.
Although companies are detecting breaches faster, security teams are still only finding 64 percent of them, which is similar to last year, and they’re collaborating with others outside their organizations to find the remaining breaches. This underscores the importance of collaborative efforts among business and government sectors to stop cyberattacks.
When asked how they learn about attacks that the security team has been unable to detect, respondents indicated that more than one-third (38 percent) are found by white-hat hackers or through a peer or competitor (up from 15 percent, comparatively, in 2017). Interestingly, only 15 percent of undetected breaches are found through law enforcement, which is down from 32 percent the previous year.
Addressing cybersecurity from the inside out
On average, respondents said only two-thirds (67 percent) of their organization is actively protected by their cybersecurity program. And, while external incidents continue to pose a serious threat, the survey reveals that organizations should not forget about the enemy from within. Two of the top three cyberattacks with the highest frequency and greatest impact are internal attacks and accidentally published information.
When asked which capabilities were most needed to fill gaps in their cybersecurity solutions, the top two responses were cyber threat analytics and security monitoring (46 percent each). Organizations realize the benefits derived from investing in emerging technologies. A large majority of respondents (83 percent) agree that new technologies such as artificial intelligence, machine or deep learning, autoation, user behavior analytics, and blockchain are essential to securing the future of organizations.
Yet, only two out of five organizations are currently investing in breakthrough technologies, indicating there is even more ground to be gained by increasing investment in cyber resilient innovations and solutions.
“Building investment capacity for wise security investments must be a priority for those organizations who want to close the gap on successful attacks even further,” said Kelly Bissell, managing director of Accenture Security.
“For business leaders who continue to invest in and embrace new technologies, reaching a sustainable level of cyber resilience could become a reality for many organizations in the next two to three years. That’s an encouraging projection.”
Five steps organizations can take to achieve cyber resilience
1.Build a strong foundation. Identify high value assets and harden them. Ensure controls are deployed across the organizational value chain, not just the corporate function.
2.Pressure test resilience like an attacker. Enhance red defense and blue defense teams with player-coaches that move between them and provide analysis on where improvements need to be made.
3.Employ breakthrough technologies. Free up investment capacity to invest in technologies that can automate your defenses. Utilize automated orchestration capabilities and advanced behavioral analytics.
4.Be proactive and use threat hunting. Develop strategic and tactical threat intelligence tailored to your environment to identify potential risks. Monitor for anomalous activity at the most likely points of attack.
5. Evolve the role of CISO. Develop the next generation CISO — steeped in the business and balancing security based on business risk tolerance.