Cyber attack volume and the number of breaches, both inflamed by the coronavirus (COVID-19) pandemic, have spiked in the last 12 months, prodding organizations to increase their cybersecurity investments, a new study of C-suite security officers said.
VMware’s inaugural U.S.-focused cybersecurity threat report, entitled Extended Enterprise Under Threat, based on input from 250 U.S.-based CIOs, CTOs and CISOs, also includes multi-country companion research to assess the impact of the COVID-19 on the cybersecurity landscape. In that research, nearly 90 percent of 1,000 cybersecurity pros surveyed in the U.S., U.K., Singapore and Italy said teleworking had increased attack volumes. A similar percentage said their organizations had experienced cyber attacks linked to the pandemic.
Key findings from the main survey include:
- 92% said attack volumes have increased in the last 12 months.
- 97% said their business has suffered a security breach in the last 12 months.
- The average organization experienced 2.7 breaches in the last 12 months.
- 84% said attacks have become more sophisticated.
- 95% plan to increase cyber defense spending in the coming year.
- OS vulnerabilities (27%) are the main cause of breaches. Web application (13.5%) and ransomware (13%) follow.
- U.S. companies average nine different security technologies to manage their security program.
Even though island-hopping, in which cyber criminals infiltrate large company networks by targeting their clients or partners, such as MSPs and MSSPs, was only linked to five percent of breaches, it is having an “increasing breach impact,” said Rick McElroy, VMware Carbon Black cyber security strategist.
In the supplemental COVID-19 cybersecurity research, notable findings include:
- 89% have been targeted by COVID-19-related malware.
- A lack of multifactor authentication was the biggest security threat to businesses.
- 83% reported gaps in disaster planning around communications with third parties.
A subset of survey results gleaned from U.S. security pros revealed that CISOs may be struggling to handle the various demands “placed on them by the COVID-19 situation,” McElroy said. Those findings include:
- 83% reported gaps in recovery planning.
- 83% had uncovered gaps in IT operations.
- 84% encountered problems around enabling a remote workforce.
- 83% had experienced challenges communicating with employees.
- 83% had experienced difficulty communicating with external parties.
- 63% had uncovered gaps around visibility into cybersecurity threats.
“The 2020 survey results suggest that security teams must be working in tandem with business leaders to shift the balance of power from attackers to defenders,” McElroy said. “We must also collaborate with IT teams and work to remove the complexity that’s weighing down the current model. By building security intrinsically into the fabric of the enterprise–across applications, clouds and devices–teams can significantly reduce the attack surface, gain greater visibility into threats, and understand where security vulnerabilities exist.”
