Talk Talk, J. D. Weatherspoon, Carphone Warehouse etc.; there has been much reporting of cyber-attacks targeted at UK and European businesses during 2015. Those organisations that have not been hit will be breathing a collective sigh of relief, and let’s face it, it could have been any of them.
Recently published Quocirca research shows that the overwhelming majority of Europe businesses now recognise the reality of targeted attacks; 24% say it is inevitable they will be hit at some point; most of the rest are concerned; and just 6% are being complacent thinking the problem of targeted attacks to be exaggerated or admitting a lack of awareness.
The high profile stories are not the only reason for concern. Much of it must be put down to bitter experience. The research behind Quocirca’s new report, called “The trouble at your door”, which was sponsored by Trend Micro, surveyed 600 European enterprises. Of these, 369 admitted they had been targeted, with 251 saying the attackers had been successful. In 133 cases this led to a data loss (64 said it was a lot of data) and 94 said they had suffered serious or significant reputational damage.
In other words, beyond the headlines about individual attacks, quantitative data shows that European enterprises have at least a 1 in 5 chance of losing data through a targeted cyber-attack. With the final details of the EU General Data Protection Regulation (GDPR) agreed this week, with fines of up to 4% of global turnover, this is not good news. Grimmer still, the reality is probably worse than this; around half of the 231 who did not think they had been targeted were not really sure. Many of them may have lost data too but simply did not know about it.
The majority think the most likely attackers will be cyber-criminals, rather than hacktivists, nation states or other commercial organisations and the target is mostly payment card and/or personal data. However, there is a positive angle; cyber-criminals mostly target an organisation because its defences are weak, not because there is some specific malicious intent. In other words, if your organisation’s defences are hard to overcome, the criminals may just move on to one of your rivals.
So, as we head into a New Year, with the onslaught of targeted cybercrime showing no sign of abating, what can be done? The research shows that certain measures reduce the likelihood of an attack being successful and limit the seriousness of the outcome when the inevitable does happen.
For example, those with technology in place to detect previously unseen malware were more likely to discover attacks underway and/or report that such attacks only had a minor impact. This is because they were able to detect attacks in hours rather than days or weeks. Even when attacks succeed, other measures can make a difference; those with breach response plans in place were considerably less likely to report reputational damage.
Of course, certain vendors will tell you that their technology will stop all attacks up front, whilst others will tell you this is not possible—you must protect all your data at source, using their product. No organisation can afford to take such claims at face value; a prudent defence strategy must include a range of before, during and after measures. Quocirca’s report looks in more detail at the effectiveness of such measures, as well as listing the Worst 40 attacks recorded during the research.
Quocirca’s report—The trouble at your door—was sponsored by Trend Micro and is free to download at this link:
https://resources.trendmicro.com/cyberattacks?_ga=1.86817944.1634337558.1450108759
