Browser-borne Malware Infects Most Companies
Spikes Security, the isolation security company, announced the results of a sweeping survey conducted by the Ponemon Institute, pre-eminent data privacy and protection experts. "The Challenge of Preventing Browser-Borne Malware" underscores gaps in best practices and priorities, and ways to improve enterprise IT approaches to defend against web-borne malware, cited as the most rapidly growing enterprise data security threat. Among key findings: web-borne malware is likely to have infiltrated more than 75% of enterprises via inherently insecure browsers.
Ponemon surveyed 645 IT and IT security practitioners directly involved in their company's efforts to detect and contain malware at US businesses with an average of more than 14,000 employees.
"The findings of this research reveal that current solutions are not stopping the growth of web-borne malware," said Dr. Larry Ponemon, chairman and founder of Ponemon Institute. "Almost all IT practitioners in our study agree that their existing security tools are not capable of completely detecting web-borne malware and the insecure web browser is a primary attack vector. Further, the findings are evidence of the need for a more effective solution to stop web-borne malware."
Although all of the companies surveyed deploy a multi-layer, defense-in-depth security architecture, these organizations still experienced an average of 51 security breaches over the past 12 months. This is due to the failure of detection-based security technologies in preventing browser-borne malware. Findings reveal the average cost to respond to and remediate just one security breach resulting from failed malware detection technology to be approximately $62,000 per breach, exclusive of fraud-related costs and impact on valuation. Ponemon estimates that such attacks and infections have cost participating organizations an average of $3.2 million to remediate a security breach caused by web-borne malware.
Other Key Findings:
- 69% of IT and security professionals that believe browser-borne malware is a more significant threat today than just 12 months ago, and is more serious than other types of malware infections;
- 89% are certain or believe that their organization has been infected without detection (surprisingly, most believe such web malware prevention remains a low organizational priority); and
- The vast majority of those surveyed cite insecure web browsers as a primary attack vector (81 percent strongly agree or agree), and that even with existing security tools, web-borne malware can be completely undetectable.
"While the Web browser has become the most strategically important application on corporate desktops, it is also, unfortunately, the most vulnerable application in terms of being a delivery channel for malware leading to cyber attacks," said Branden Spikes, CEO, CTO and founder, Spikes Security. "What many organizations forget is that the browser is the only application that is permitted to download and execute code from a 3rd party location -- any external web site. Every time you allow unknown code into your network, you put yourself and your business at risk. This is why browser isolation outside the network is so important. It is the only way to prevent this problem."
A reflection of today's current technologies uses to protect organizations, 74 percent of those surveyed strongly agree or agree that traditional detection-based technologies are becoming ineffective in stopping these attacks. Additionally, only 31 percent of respondents strongly agree or agree that commercial browsers contain effective security tools for blocking web-borne malware.
Detailed Survey Findings and Analysis
- A barrier to the detection and containment of malware is a lack of resources. Seventy-seven percent of respondents say it is certain or very likely their organizations have been infected by web-borne malware that was undetected. According to 51 percent of respondents, they are not receiving the resources or budget they need to effectively detect and contain this threat and 49 percent of respondents say defending against web-borne malware is not a security priority. As a result, the majority of respondents (52 percent) rate their ability to detect and contain web-borne malware as very weak or weak.
- Users' insecure web browsers cause the majority of total malware infections. The web browser is a common attack vector that can severely impact their organization's security posture. On average, a user's insecure web browser is the cause of 55 percent of the total malware infections.
- Sandboxes and content analysis engines help, but do not solve the problem. Some 38 percent of respondents say web-borne malware was still able to bypass this solution. In addition, 50 percent say the web-borne malware was able to bypass their organization's layered firewall defense. Forty-six percent say the organization's anti-virus solution was not a deterrent and 41 percent say web-borne malware was able to bypass intrusion detection systems. This suggests that an effective solution is still required to ensure that no browser-borne malware is able to penetrate the network, breach desktop browsers or gain access to sensitive internal resources.
- Organizations are willing to pay a premium to stop browser-borne malware. Organizations would allocate an average of 33 percent of their total security budget to stop web-borne attacks by 50 percent. To stop 100% of these attacks, they would allocate an average of 50 percent of the budget. The average annual IT security budget is approximately $7.8 million and 39 percent of the budget is spent on defense-and-depth security tools such as web gateways, IPS, anti-virus, which have proven to be ineffective.
- Dependency on traditional detection methods deters organizations from adopting new solutions. Sixty-five percent of respondents say overcoming psychological dependency upon traditional detection methods would be a main barrier to adopting a browser isolation technique that rendered traditional web-borne malware detection and containment methods obsolete and unnecessary. This is followed by concerns over diminished user productivity (50 percent), system performance issues (44 percent) or complexity and difficulty to operate (41 percent).