AT&T, one of the largest Internet service providers on the planet, recently revealed that its network is constantly under attack, receiving over 30 billion malicious scans, 400 million spam messages, and over 200,000 malware attacks every day.
According to Jason Porter, AT&T Security Solutions Vice President, most of these scans are known operations, with crooks looking for weak entry points. The organization says it only managed to block 5 billion of these scans in 2015.
The numbers are staggering, but most of these malware attacks come from scripts, meaning there is little human oversight and a high degree of automation.
AT&T recorded over 245,000 DdoS attacks and revealed that over 245,000 DDoS attacks targeting its network were detected, which often led to data breaches or other incidents.
AT&T said that 60% of businesses surveyed have experienced an IT security breach and 42% reported that the breach had a serious and negative impact on their infrastructure.
Large businesses reported a total of 23 hours of downtime during 2015, and mid-sized businesses reported about 14 hours.
All of this led to millions in lost revenue.
Despite these numbers, only 34% of companies surveyed said they had an incident response plan (IRP).
AT&T provides a blueprint for incident response plans.
IRPs grow in importance as the company grows and develops, primarily because they establish the procedures that can be followed when a cyber-attack is detected and to avoid prolonged disruption or data theft.
A good IRP is like a unicorn for most CSOs, and in most cases the best plans were devised with the help of a security auditor.
Incident response plans define a course of action, not only for data breaches or DDoS attacks, but also for the simplest and most common accidents, such as the loss of a data drive or all types of malware, including ransomware.
In order to inform and educate companies on appropriate response procedures for cyber-incidents (malware, etc.), AT&T has published The CEO's Guide to Cyberbreach Response.
