Attack types companies expect to encounter in 2017

What are the key attack types expected to cause the biggest security problems in 2017 and how successful will businesses be at defending against them?

Tripwire and Dimensional Research asked 403 IT security professionals at companies with more than 1,000 employees based in the US, UK, Canada and Europe, and their answers revealed that only 3 percent of organizations have the technology and only 10 percent have the skills in place to address today’s top attack types.

According to the study, ransomware has the potential to inflict the most significant damage to organizations in 2017, yet not even half of those surveyed have the skills (44 percent) or the technology (43 percent) to effectively address it.

The respondents were also asked about their skills and technology, specific to each of the attack types. Tripwire found that most felt confident in their skills to tackle phishing (68 percent) and DDoS attacks (60 percent), but less confident in their abilities to address insider threats (48 percent), vulnerability exploitations (45 percent) and ransomware (44 percent).

Regarding technology, the findings once again revealed more confidence in addressing phishing (56 percent) and DDoS attacks (63 percent), with less than half of the companies having the technology to address ransomware (43 percent), insider threats (41 percent) and vulnerabilities (40 percent).

“The results of this study highlight that there are very few organizations equipped to deal with all of today’s major attack types. Most organizations can reasonably handle one or two key threats, but the reality is they need to be able to defend against them all,” said Tim Erlin, senior director of IT security and risk strategy for Tripwire.

“The unfortunate reality is that today’s determined cybercriminals will target organizations with a variety of different attack techniques until they are successful. Organizations need to work with security vendors that have the ability to help them address all of today’s major attack types, while also offering IT teams with training to help educate them on new trends.”

The findings of study indicated that foundational security controls would help address these challenges. While two out of three respondents stated they use security standards or frameworks that include a set of foundational controls, 93 percent responded “yes” when asked if the adoption of foundational security controls would improve their readiness to protect against new security threats.

Additional key findings include:

• The enforcement of foundational security controls is challenging, with 65 percent of respondents indicating they lack the ability to effectively enforce them.
• 64 percent of respondents believe financial services will be hit hardest by cybercriminals in 2017.
• While US respondents were more concerned about the health care sector (46 percent), European respondents were more concerned about telecommunications companies (59 percent).