Cyberattacks are constantly increasing and coming from anywhere. This leaves IT managers powerless to react to the successive attacks they receive, due to budget, technology but unfortunately also know-how. This is according to a study conducted by software and hardware security company, Sophos, called “The Impossible Puzzle of Cybersecurity”.
The study, which surveyed IT decision-makers from midsize businesses in the US, Canada, Mexico, Colombia, Brazil, the UK, France and South Africa, found that attack are diverse and often multiple, increasing the difficulty of defending networks. One in five IT managers surveyed didnot know the vulnerability that allowed the attack.
According to Chester Wisniewski, Sophos’ chief research scientist, organizations that simply fix problems externally remain vulnerable internally. 53% of those who fell victim to a cyberattack said they were hit by phishing emails and 30% by ransomware.
It’s no surprise that 75% of IT managers consider software exploits, unpatched vulnerabilities, and zero-day threats to be some of the biggest security risks. Others consider phishing to be the biggest security risk.
Cybercriminals are constantly creating ways to attack an organization, and supply chain attacks are usually their first choice . That’s why managers need to focus their efforts there. On the other hand, in South Africa , only 16% said they actually considered it a risk.
Other findings from the Sophos survey show that IT managers reported that 26% of their team’s time is spent on security management. However, 86% agree that security expertise can be improved and 80% want a stronger team to detect, investigate and respond to security incidents.
When it comes to their company’s budget, 66% said their organization’s cybersecurity budget is less than it needs to be. Additionally, 75% agree that keeping an organization up to date in this area is extremely difficult. The lack of knowledge in the field of security, budgeting and modern technology suggests that managers are struggling to cope with attacks, rather than preparing for the next ones.
Finally, Wisniewski says that keeping organizations about potential threats is difficult, but if organizations can adopt a security with tools that work to share information and react automatically to threats, then IT security teams will be able to deal with anything that arises much more quickly and easily.
