VMware Global Security Insights Report 2021
Here we present the key findings from VMware’s 2021 global security report.
“Attack Frequency and Breach Risk Remain High”
As we stressed in our initial look at this year’s report from VMware, attacks over the past year have not only increased in volume, but have become more sophisticated as well. For this reason, we saw a rise in the number of breaches reported worldwide.
Of those who faced attacks this year:
- 76% reported that attack volumes had increased
- 78% reported that working from home was the cause of the rise in attacks
- 79% reported that attacks have become more sophisticated
- 81% reported that they faced attacks within the last 12 months and on average faced 2.35 attacks per month
- 82% reported that they faced material attacks
- 56% are afraid that they will be hit with a material breach in the next 12 months
A material breach is one that is serious enough to require reporting to an regulators (i.e. FBI, security watchdogs, etc.) as well as action from an internal incident response team (or IR team). These are significant incidents that impact the company, customers/clients, and in some cases the infrastructure of a country or region depending on the attacker’s motive.
Top Three Threats Demonstrate Internal Weaknesses
The top three causes for breaches in the past year were:
- Third party apps – 14.4%
- Ransomware – 14.3%
- Out-of-date security measures – 14%
Out-of-date security measures and process weaknesses were both tied for third place at 14%, and the two go hand in hand.
Third party apps have been targeted relentlessly by attackers, especially Window’s products such as Microsoft Outlook which is widely used in professional settings for all basic communication. Google applications have also been targeted. App developers have been under increased pressure to issue security updates with increased detected attacks.
RELATED New WordPress Vulnerability Disclosed
Ransomware incidents have been at a high, and cyber-insurance has made it less scary to pay ransom to attackers. This goes against strong recommendations from the FBI and foreign security watchdogs who urge citizens and companies not to encourage further attacks by awarding attackers with fulfilled demands. Ransomware is notoriously profitable for cybercriminals for this reason.
Out-of-date security measures have been a great issue during the massive workforce changes over the past year. IT departments have been focusing on moving the workforce to remote working, and are playing catchup on the security aspect of the change. Many companies were not implementing multifactor authentication (MFA) nor mandating cybersecurity training for their employees. National Securities Corporation faced a $3 million fine for neglecting to do just that. As a result of their failure to implement basic safety measures, the insurer experienced a massive data breach affecting their clients.
How Are Leaders Responding?
Leaders understand that the rise in attacks and risk of breach require changes to our current approach to cybersecurity:
- 61% agree that cybersecurity needs to viewed differently as the volume and sophistication of attacks has been expanding
- 63% agree that better contextual security needs to be put in place to track data through the life cycle. This means that all data should be tracked from creation to deletion.
- 63% agree that better visibility is necessary over data and in apps to prevent or at least anticipate attacks.
Chief Information Security Officers have had their work cut out for them this year. Fortunately, they are up to the challenge:
- 43% are building more security into infrastructure and applications and are reducing the number of “point solutions” or services/software that only serve to solve a single problem.
- 42% have updated security technology to address new risks
- 41% have updated security policy as well as their internal IR procedures
- 98% have shifted or plan to shift to a cloud-first security strategy
What Does the Future of Modern Businesses Look Like?
Many companies have been toying with the idea, or have already been working on utilizing artificial intelligence either in their products or in their operations. However, as security risks have been on the up and up, businesses are reluctant to move forward with a leap into A.I. operations.
- 56% of respondents report that security concerns are the root of their hesitance to embrace AI/machine learning (ML) apps and services
- 63% agree that such innovation is dependent on assurance that their applications and services are getting into consumers’ hands safely
- 57% say that the security solutions industry is too complex to allow them to change their security policies, despite the fact that their current policies are insufficient for today’s cybersecurity needs
- 60% state that executives are worried or anxious when releasing new products or services because of the way that attacks have grown and evolved
- 62% report that they would like to be able to use AI/ML to improve their security and services
Companies who faced breaches and attacks have reported to experience damage to their brand and/or reputation:
- 75% say that there was a negative impact on their reputation
- 82% had to report to regulators or engage an IR firm to handle the public fallout caused by material breaches in the past year
- 56% are fearful that they will experience a material breach in the next year
- 41% have taken action and updated security measures in preparation for future attacks
