Sophos has announced the findings of its global survey, “7 Uncomfortable Truths of Endpoint Security,” which reveals that IT managers are more likely to catch cybercriminals on their organisation’s servers and networks than anywhere else. In fact, IT managers discovered 37% of their most significant cyberattacks on their organisation’s servers and 37%t on its networks. Only 17% were discovered on endpoints and 10% were found on mobile devices. The survey polled more than 3,100 IT decision makers from mid-sized businesses in 12 countries including the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.
“Servers store financial, employee, proprietary, and other sensitive data, and with stricter laws like GDPR that require organisations to report data breaches, server security stakes are at an all-time high. It makes sense that IT managers are focused on protecting business-critical servers and stopping attackers from getting on the network in the first place and this leads to more cybercriminal detections in these two areas,” said Chester Wisniewski, principal research scientist, Sophos. “However, IT managers can’t ignore endpoints because most cyberattacks start there, yet a higher than expected amount of IT managers still can’t identify how threats are getting into the system and when.”
Twenty percent of IT managers who were victim to one or more cyberattacks last year can’t pinpoint how the attackers gained entry, and 17% don’t know how long the threat was in the environment before it was detected, according to the survey. To improve this lack of visibility, IT managers need endpoint detection and response (EDR) technology that exposes threat starting points and the digital footprints of attackers moving laterally through a network.
On average, organisations that investigate one or more potential security incidents each month spend 48 days a year (four days a month) investigating them, according to the survey. It comes as no surprise that IT managers ranked identification of suspicious events (27%), alert management (18%) and prioritisation of suspicious events (13%) as the top three features they need from EDR solutions to reduce the time taken to identify and respond to security alerts.
Fifty-seven percent of respondents said they were planning to implement an EDR solution within the next 12 months. Having EDR also helps address a skills gap. Eighty percent of IT managers wish they had a stronger team in place, according to the survey.
The 7 Uncomfortable Truths of Endpoint Security survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019.