Discovering Cybercriminals Entry Points Remains Elusive

Companies are getting better at catching cybercriminals on networks and servers, but struggle to find out how they infiltrated in the first place.

According to a recent global survey by Sophos, 7 Uncomfortable Truths of Endpoint Security, 37 percent of attacked are caught in servers and 37 percent on networks. But, the survey also revealed that only a sobering 17 percent are discovered at endpoints and 10 percent on mobile servers.

The survey, which polled more than 3,100 IT decision makers from mid-sized businesses in 12 countries including the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa, concluded that companies need to start paying close attention to their endpoints. It was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019.

“Servers store financial, employee, proprietary, and other sensitive data, and with stricter laws like GDPR that require organizations to report data breaches, server security stakes are at an all-time high. It makes sense that IT managers are focused on protecting business-critical servers and stopping attackers from getting on the network in the first place and this leads to more cybercriminal detections in these two areas,” said Chester Wisniewski, principal research scientist, Sophos.

"However, IT managers can't ignore endpoints because most cyber attacks start there, yet a higher than expected amount of IT managers still can't identify how threats are getting into the system and when,” he added.

The survey noted that 20 percent of IT managers who suffered cyber attacks are not sure how the attackers gain entry. Seventeen percent also did not know how long the attackers were in their environment before being caught.

“If IT managers don’t know the origin or movement of an attack, then they can’t minimize risk and interrupt the attack chain to prevent further infiltration,” said Wisniewski. 

It makes endpoint detection and response (EDR) vital. “EDR helps IT managers identify risk and put a process in place for organizations at both ends of the security maturity model. If IT is more focused on detection, EDR can more quickly find, block and remediate; if IT is still building up a security foundation, EDR is an integral piece that provides much-needed threat intelligence," said Wisniewski.

However, polled survey participants argued that EDR needs to reduce the time taken to identify an attacker.

The survey noted that organizations that investigate one or more potential security incidents each month spend 48 days a year (four days a month) examining them. It makes identification of suspicious events (27 percent), alert management (18 percent) and prioritization of suspicious events (13 percent) the top three features that they wanted in EDR solutions.

“Most spray and pray cyberattacks can be stopped within seconds at the endpoints without causing alarm. Persistent attackers, including those executing targeted ransomware like SamSam, take the time they need to breach a system by finding poorly chosen, guessable passwords on remotely accessible systems (RDP, VNC, VPN, etc.), establish a foothold and quietly move around until the damage is done," said Wisniewski.

“If IT managers have defense-in-depth with EDR, they can also investigate an incident more quickly and use the resulting threat intelligence to help find the same infection across an estate. Once cybercriminals know certain types of attacks work, they typically replicate them within organizations. Uncovering and blocking attack patterns would help reduce the number of days IT managers spend investigating potential incidents,” he added.