International
United Kingdom
United States
Saudi Arabia
Australia
MCLEAN, VA, March 4, 2019 -- Organizations have long focused their cybersecurity positioning around prevention; however, with the sophistication and frequency of attacks increasing, more organizations are beginning to prioritize incident response teams, groups of specialists trained to address and defeat attacks that make it past existing protections. Today, BAE Systems released insights from its new incident response report, which shines a light on the cause of these breaches.
BAE Systems surveyed board level executives, IT decision makers, and information security professionals to understand the current state of corporate incident response capabilities and readiness. Organizations ranged from governmental agencies to healthcare and technology firms, and from small (less than 500 employees) to large (more than 10,000 employees) enterprises.
Human error continues to be a major concern
A major finding from the results showcase how many of the organizational breaches are caused by human error, with attackers preying on human nature and employees making honest -- but costly -- mistakes in the course of their daily routine.
A major finding from the results showcase how many of the organizational breaches are caused by human error, with attackers preying on human nature and employees making honest -- but costly -- mistakes in the course of their daily routine.
- 71 percent of incidents were phishing attacks.
- 65 percent were untargeted viruses or malware.
Incident response teams are dealing with an increasing number of incidents per month
- 66 percent of organizations responded to between one and 25 cybersecurity incidents per month
- 26 percent of organizations responded to between 25 and 99 incidents per month.
- Nearly 8 percent responded to 100 or more incidents per month.
Many organizations are just not prepared to respond to cyber threats
- 23 percent of incident response teams do not conduct readiness exercises with senior management, missing an opportunity for both executive buy-in and staff skill development.
- 22 percent only have temporary or no incident response resources in place.
Mike Hepple, Security Consulting Manager in North America with BAE Systems Applied Intelligence, said:
“With the number of breaches continuing to increase and human error being a significant concern for companies, the importance of having incident response plans in place is more critical now than ever before. We found that 22 percent of the organizations we surveyed had only temporary or no incident response resources in place. This means that far too many companies are ignoring a large piece of their cybersecurity defense.”
“With the number of breaches continuing to increase and human error being a significant concern for companies, the importance of having incident response plans in place is more critical now than ever before. We found that 22 percent of the organizations we surveyed had only temporary or no incident response resources in place. This means that far too many companies are ignoring a large piece of their cybersecurity defense.”
“Given a clear understanding of the threat landscape and internal policy, incident response teams can triage, investigate, and mitigate security events effectively. Creating response plans can help align an organization’s workforce and procedures and even develop threat-modeled scenarios specific to each organization. The rise and refinement of social engineering tactics such as ‘phishing’ highlights the necessity to focus on training and awareness for all within an organization, with crisis planning ensuring that all employees understand the importance of cybersecurity and their specific role. With this in place, organizations can ensure they are prepared in the event of a data compromise.”
To help with this business challenge, BAE Systems has published their 2019 incident response report, ‘Why Ignoring Incident Response Could Spell Disaster,’ which includes a check list to help companies document their existing security preparedness.
To learn more about incident response and download the report, visit www.baesystems.com/IRreport
ENDS
For further information, please contact:
BAE Systems
Nick Haigh, BAE Systems
+44 (0) 7525 390982
nick.haigh@baesystems.com
BAE Systems
Nick Haigh, BAE Systems
+44 (0) 7525 390982
nick.haigh@baesystems.com
Notes to Editors:
Report Survey Methodology
Number of Employees
- Less than 1,000 28%
- 1,000 - 10,000 66%
- More than 10,000 6%
Industry
- Technology 16%
- Banking & Finance 22%
- Government 6%
- Healthcare 6%
- Education 8%
- Job Function
- IT/Security Analyst 40%
- C-Suite/Management 22%
- Compliance 4%
- Fraud/Risk Management 2%
Geography
- United States 67%
- United Kingdom 29%
- Canada 2%
About BAE Systems
At BAE Systems, we provide some of the world's most advanced technology defense, aerospace and security solutions. We employ a skilled workforce of 82,500 people in over 40 countries. Working with customers and local partners, our products and services deliver military capability, protect people and national security, and keep critical information and infrastructure secure.
At BAE Systems Applied Intelligence, we help nations, governments and businesses around the world defend themselves against cybercrime, reduce their risk in the connected world, comply with regulation, and transform their operations. For further information about BAE Systems Applied Intelligence, please visit www.baesystems.com/businessdefence.