Sophos, a network and endpoint security provider, has revealed that IT managers are more likely to catch cybercriminals on their organisation’s servers and networks than anywhere else
The study, 7 Uncomfortable Truths of Endpoint Security, surveyed more than 3,100 IT decision makers from mid-sized businesses in 12 countries including the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.
The report found that IT managers discovered 37 per cent of the most significant cyber attacks on their organisation’s servers and 37 per cent on its networks. Only 17 per cent were discovered on endpoints and 10 per cent were found on mobile devices.
Chester Wisniewski, a principal research scientist, Sophos, said, “Servers store financial, employee, proprietary, and other sensitive data, and with stricter laws like GDPR that require organisations to report data breaches, server security stakes are at an all-time high. It makes sense that IT managers are focused on protecting business-critical servers and stopping attackers from getting on the network in the first place and this leads to more cybercriminal detections in these two areas.”
“However, IT managers can’t ignore endpoints because most cyber attacks start there, yet a higher than expected amount of IT managers still can’t identify how threats are getting into the system and when,” he added.
The report further added that twenty per cent of IT managers who were victim to one or more cyber attacks last year can’t pinpoint how the attackers gained entry, and 17 per cent doesn’t know how long the threat was in the environment before it was detected, according to the survey.
To improve this lack of visibility, IT managers need endpoint detection and response (EDR) technology that exposes threat starting points and the digital footprints of attackers moving laterally through a network.
“If IT managers don’t know the origin or movement of an attack, then they can’t minimize risk and interrupt the attack chain to prevent further infiltration,” said Wisniewski. “EDR helps IT managers identify risk and put a process in place for organizations at both ends of the security maturity model. If IT is more focused on detection, EDR can more quickly find, block and remediate; if IT is still building up a security foundation, EDR is an integral piece that provides much-needed threat intelligence.”
About fifty-seven per cent of respondents stated that they were planning to implement an EDR solution within the next 12 months. Having EDR also helps address a skills gap. Eighty per cent of IT managers wish they had a stronger team in place, according to the survey.
