Although awareness of cyber risks is growing, a large number of companies still believe they are impervious to cyber attacks and data breaches.
However, implausible it may sound, the fact that a company hasn’t noticed a breach doesn’t mean that a breach hasn’t taken place. Mandiant’s new M-Trends report (M-Trends 2017: A View from the Front Lines) reveals unnerving statistics about the discovery of data breaches that should discourage complacency and urge action.
How long do criminals spend undetected on a victim’s network?
According to Mandiant, in 2016 it took organizations an average of 99 days to detect attackers within their network environments. Although this is an improvement from 2015, when organizations took an average of 146 days, attackers still have ample time to do serious damage while remaining undetected.
With increasing pressure on organizations to disclose not only data breaches but also details about the attacks, it’s not hard to imagine the embarrassment as well as reputational and financial implications of admitting that your systems were breached months ago without you even noticing.
How are compromises detected?
Past experience shows that the majority of breached organizations are notified of incidents by an ‘outside entity’. Often the notifying parties are law enforcement.
However, detection and escalation costs are at a record high, according to IBM’s 2017 Cost of Data Breach Study. Average detection and escalation costs have increased dramatically, from $0.73 million in 2016 to $1.07 million in 2017, suggesting that companies are investing more heavily in these activities.
Which attacks are working?
Although the nature of attacks varies, phishing attacks are among the most effective. A recent Wombat security report revealed that there was a staggering 155% increase in the number of phishing emails across the US and UK compared to the previous year’s report.
Growing staff awareness threats
The IT Governance Security Awareness Program helps you generate tangible and lasting organization-wide staff awareness, and is ideal for larger organizations looking to tackle the problem of ransomware risks and other data breach threats from uninformed or negligent staff.
Combining a learning needs assessment with the deployment of a custom program supported by awareness interventions, the complete Security Awareness Program differs substantially from traditional staff awareness courses because it brings about a total shift in staff mindset and behavior, and is customized to suit your organization’s culture and awareness challenges.
Each intervention can be customized and delivered through different media, channels and formats to ensure a better fit with your organization’s needs, culture and values.
Through customized learning aids, training, resources and tools, the messages strike a chord to ensure greater and lasting results.
Find out how your organization can benefit from our Security Awareness Program and reduce your risk of a data breach due to staff negligence.
