February 27, 2017 By Douglas Bonderud 2 min read

In IT security, speed is everything. If security professionals can’t stay one step ahead of cybercriminals, both systems and data are at risk.

But this is no easy task. As noted by Silicon Angle, threat actors are constantly improving their arsenals with new attack vectors while also enhancing high-value threats such as ransomware. It’s no surprise that companies rely on a mix of manual, automated and third-party security controls to keep malicious actors at bay, even as they work to predict what comes next.

The problem? There’s little chance fraudsters will have trouble hurrying past existing security measures. According to “The Black Report” by Nuix, most penetration testers need less than 12 hours to compromise corporate networks.

Breaking Security Controls in Time for Dinner

As noted by ZDNet, the survey of 70 professional hackers doesn’t paint a pretty picture. Eighty-eight percent of respondents said most network defenses could be breached in under 12 hours, and one-third reported that their activities had never been noticed by a potential target.

It gets worse from there: About 17 percent of survey participants claimed they could compromise security controls in just two hours. Forty-three percent said they had the most luck with direct server attacks and 40 percent preferred to phish for vulnerabilities. Also worth noting, 30 percent reported that they could “find and siphon out target data” in under six hours, while approximately 20 percent claimed they could manage the job in less than two, according to Dark Reading.

These are just penetration testers — professionals who are contracted by companies to gauge the readiness of network security systems. This means they’re governed by at least basic rules of engagement, which forbid actually destroying data or rendering networks useless. Black-hat hackers come with no such scruples.

Hitting Back With Agile Security and Threat Hunting

Existing security controls aren’t enough to defend corporate systems and keep data safe, so how can companies limit the chance of total compromise? Agile security is part of the answer. Cloud-based solutions and robust data analytics can help fend off less-committed attackers.

But stopping cybercriminals in their tracks requires a different outlook. As noted by TechTarget, there’s a new role emerging in enterprise security: the threat hunter. Think of it like a penetration tester with the sole purpose of finding security holes overlooked by automated tools.

According to Johna Till Johnson of Nemertes Research, these threat hunters are “part of a mature security operation” and can help shift companies from reactive or proactive to “anticipatory,” postures, TechTarget noted. That allows them to focus on new and emerging threats rather than playing catch-up with existing attack vectors.

The bottom line is that current security controls won’t keep out determined fraudsters. In under half a day, most can crack corporate systems and exfiltrate target data. While purpose-built, agile security tools can help extend the time needed to break down corporate walls, substantial posture shifts depend on a combination of automated detection and human-hunted threats.

More from

Cloud Threat Landscape Report: AI-generated attacks low for the cloud

2 min read - For the last couple of years, a lot of attention has been placed on the evolutionary state of artificial intelligence (AI) technology and its impact on cybersecurity. In many industries, the risks associated with AI-generated attacks are still present and concerning, especially with the global average of data breach costs increasing by 10% from last year.However, according to the most recent Cloud Threat Landscape Report released by IBM’s X-Force team, the near-term threat of an AI-generated attack targeting cloud computing…

Testing the limits of generative AI: How red teaming exposes vulnerabilities in AI models

4 min read - With generative artificial intelligence (gen AI) on the frontlines of information security, red teams play an essential role in identifying vulnerabilities that others can overlook.With the average cost of a data breach reaching an all-time high of $4.88 million in 2024, businesses need to know exactly where their vulnerabilities lie. Given the remarkable pace at which they’re adopting gen AI, there’s a good chance that some of those vulnerabilities lie in AI models themselves — or the data used to…

FBI, CISA issue warning for cross Apple-Android texting

3 min read - CISA and the FBI recently released a joint statement that the People's Republic of China (PRC) is targeting commercial telecommunications infrastructure as part of a significant cyber espionage campaign. As a result, the agencies released a joint guide, Enhanced Visibility and Hardening Guidance for Communications Infrastructure, with best practices organizations and agencies should adopt to protect against this espionage threat. According to the statement, PRC-affiliated actors compromised networks at multiple telecommunication companies. They stole customer call records data as well…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today