The amount of time spend cybercriminals inside compromised networks has decreased, according to a new report . This could be considered a positive development, as it shows that victims are discovering cyberattacks sooner and are not giving hackers time. But it seems that the increase in ransomware attacks is also playing a role.
See also: Finnish Parliament: Chinese hackers behind last year's hack?
FireEye Mandiant security researchers analyzed hundreds of cyber incidents and found that the average dwell time on networks – the time from the initiation of a breach to its detection – has decreased to 24 days.
According to the M-Trends 2021 annual threat report, this means incidents are being detected twice as quickly as last year, when the average dwell time was 56 days. About 10 years ago, it took organizations about a year to realize that cybercriminals had infiltrated their network.
The decrease in hackers' dwell time is due in part to organizations' improved detection and response capabilities, but researchers noted that the increase in ransomware attacks has also played a role.
Ransomware attacks are one of the biggest threats in cyberspace. Criminals infiltrate networks, encrypt them, and then demand a ransom from victims, usually in Bitcoin.
See also: Dutch supermarkets run out of cheese after ransomware attack
These cyberattacks are extremely profitable for criminals. Victims realize they have been attacked when they see that their network is encrypted and receive a ransom note from the hackers.
One of the main advantages of ransomware attacks is that they have the potential to offer criminals a lot of money in a relatively short period of time. Once they have compromised all the required elements on the network, they infect the network with ransomware. There is no reason to wait. So, they stay on the networks for a short period of time.
Ransomware attacks are extremely successful and will certainly keep security researchers busy for a long time to come.
See also: Capcom – ransomware attack: Hackers gained access to its network through an old VPN
However, it is not the only threat organizations face. Phishing and other malware are also very common.
It's good that organizations are able to detect cyberattacks faster in cyberspace. However, the best way to protect an organization is to detect and prevent the attack before the network is breached.
FireEye Mandiant researchers recommend some basic security principles, including regular system updates, to prevent criminals from exploiting known vulnerabilities.
Source: ZDNet
