Rapid7, Inc. (NASDAQ: RPD), a leading provider of security data and analytics solutions, released the results of its 2015 Incident Detection and Response Survey. The survey includes findings from hundreds of security professionals at organizations of varied sizes across the globe on their biggest security concerns and planned initiatives for 2016. Punctuating the results were two key points: (1) 90% of organizations are worried about compromised credentials, though 60% say they cannot catch these types of attacks today; and (2) 62% of organizations are receiving more alerts than they can feasibly investigate.
These key findings are strongly underscored by the fact that compromised credentials have been the leading attack vector for the last five years according to the Verizon 2015 Data Breach and Investigations Report. Additionally, intruders generally remain undetected for an average of 197 days within retail organizations and 98 days within financial services organizations once they’ve breached a network.
“Security professionals are struggling to detect and investigate incidents because the monitoring solutions available do not provide visibility into today’s modern IT environments and cannot give users the insight they need to make decisions quickly,” said Lee Weiner, senior vice president of products and engineering at Rapid7. “This lack of understanding – or context – is causing massive alert fatigue and leaving companies unable to effectively detect the most used attack method today: compromised credentials.”
Information security teams are expected to mitigate risk in sprawling environments, where employees are remotely accessing the network, at any time, from any place. The network perimeter has now expanded to include cloud services, mobile devices, and global workforces that encompass partners and contractors, making prevention as the sole security strategy effectively obsolete. Preventative solutions alone cannot protect against many of the most common attack vectors behind breaches, such as phishing and stolen credentials.
In an effort to better monitor their IT environments, security teams are investing further in incident detection and response solutions to detect and contain compromise when it occurs. However, while 55% of organizations say they are using a SIEM (Security Information and Event Management) to aid with incident detection and response, alarmingly, 62% of these organizations report receiving more alerts than they can handle. In addition, SIEMs are not being used to monitor cloud services in use, leaving organizations blind to this important part of modern IT environments.
Additional highlights from the survey include:
Rapid7 is a leading provider of security data and analytics solutions that enable organizations to implement an active, analytics-driven approach to cyber security. We combine our extensive experience in security data and analytics and deep insight into attacker behaviors and techniques to make sense of the wealth of data available to organizations about their IT environments and users. Our solutions empower organizations to prevent attacks by providing visibility into vulnerabilities and to rapidly detect compromises, respond to breaches, and correct the underlying causes of attacks. Rapid7 is trusted by more than 5,100 organizations across 99 countries, including 37% of the Fortune 1000. To learn more about Rapid7 or get involved in our threat research, visit www.rapid7.com.