Current Filter: Security>>>>>Comment>

   

It's a sound question to hang on to for those organisations that know deep down (perhaps not that deep down?) that they are far more vulnerable to an attack than they should or need be.

It's something that many won't even talk about openly, recognising that there are major flaws in their security strategy they would rather did not become public knowledge. For some, that security strategy does not yet even exist.

That makes the latest Annual Security Report from Cisco particularly timely reading. It reveals that scarcely over half (54%) of businesses are confident in their ability to verify and defend against an attack. The lack of confidence is driven largely by today's hackers becoming more nimble, resilient and persistent, with businesses struggling to keep pace with agile infrastructure and effective organisational practices. Moreover, the report highlights that 85% of organisations are affected by malicious browser extensions.

The report provides insight on the current threat landscape across sectors such as healthcare, financial services and government, highlighting the latest trends in cybercrime, emerging vulnerabilities and the state of enterprise security preparedness. It also reveals that cybercriminals are leveraging legitimate resources to launch their campaigns - JavaScript and Facebook scams were cited as the most common attack methods and the number of WordPress domains used by criminals has risen by 221%.

There are other worrying findings, too, such as encrypted traffic having reached a tipping point, creating a false sense of security and blind spots for defenders, while 92% of devices across the internet are said to be running known vulnerabilities.

As Cisco points out, businesses are up against security challenges that inhibit their ability to detect, mitigate and recover from common and professional cyberattacks. "Ageing infrastructure and outdated organisational structure and practices are putting them at risk," it warns.

This report is flagged up by the company as a "call-to-arms for greater collaboration and investment in the processes, technologies and people to protect against industrialized adversaries". The trouble is, how many calls must there be before businesses take up those arms and defend themselves properly?

Brian Wall
Editor
Computing Security
brian.wall@btc.co.uk