Security experts have been talking about mobile devices as one of the most vulnerable to attacks and may be the gateway for crybecriminals in launching more serious attacks. However, in security solutions firm Sophos’ global survey, it was found out that 37 percent of the most significant cyberattacks happen on networks with 17 percent are on endpoints and only 10 percent were found on mobile devices.

The survey titled “7 Uncomfortable Truths of Endpoint Security” polled more than 3,100 IT decision-makers from mid-sized businesses in 12 countries including Australia, Brazil, Canada, Colombia, France, India, Japan, Mexico, South Africa, and the United States. It was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019.

“Servers store financial, employee, proprietary, and other sensitive data, and with stricter laws like GDPR (General Data Protection Regulatio) that require organizations to report data breaches, server security stakes are at an all-time high,” said Chester Wisniewski, principal research scientist, Sophos. “It makes sense that IT managers are focused on protecting business-critical servers and stopping attackers from getting on the network in the first place and this leads to more cybercriminal detections in these two areas. However, IT managers can’t ignore endpoints because most cyberattacks start there, yet a higher than expected amount of IT managers still can’t identify how threats are getting into the system and when.”

Clueless

While the survey revealed that 17 percent of IT managers remain clueless as to how attackers were able to gain entry into their network, a significant 27 percent are certain as to how and where they were attacked. These are managers who experienced a cyberattack at least once last year.

To improve this lack of visibility, IT managers need endpoint detection and response (EDR) technology that exposes threat starting points and the digital footprints of attackers moving laterally through a network.

“If IT managers don’t know the origin or movement of an attack, then they can’t minimize risk and interrupt the attack chain to prevent further infiltration,” said Wisniewski. “EDR helps IT managers identify risk and put a process in place for organizations at both ends of the security maturity model. If IT is more focused on detection, EDR can more quickly find, block and remediate; if IT is still building up a security foundation, EDR is an integral piece that provides much-needed threat intelligence.”

On average, organizations that investigate one or more potential security incidents each month spend 48 days a year (four days a month) investigating them, according to the survey. IT managers ranked identification of suspicious events (27 percent), alert management (18 percent) and prioritization of suspicious events (13 percent) as the top three features they need from EDR solutions to reduce the time taken to identify and respond to security alerts.

Defense-in-depth EDR

“Most spray and pray cyberattacks can be stopped within seconds at the endpoints without causing alarm. Persistent attackers, including those executing targeted ransomware like SamSam, take the time they need to breach a system by finding poorly chosen, guessable passwords on remotely assessable systems (RDP, VNC, VPN, etc.), establish a foothold and quietly move around until the damage is done,” said Wisniewski. “If IT managers have defense-in-depth with EDR, they can also investigate an incident more quickly and use the resulting threat intelligence to help find the same infection across an estate. Once cybercriminals know certain types of attacks work, they typically replicate them within organizations. Uncovering and blocking attack patterns would help reduce the number of days IT managers spend investigating potential incidents.”

Fifty-seven percent of respondents said they were planning to implement an EDR solution within the next 12 months. Having EDR also helps address a skills gap. Eighty percent of IT managers wish they had a stronger team in place, according to the survey. More information is available in the 7 Uncomfortable Truths of Endpoint Security PDF and on Sophos News.