Browser-borne Malware Infects Most Companies

Spikes Security, the isolation security company, announced the results of a sweeping survey conducted by the Ponemon Institute, pre-eminent data privacy and protection experts. "The Challenge of Preventing Browser-Borne Malware" underscores gaps in best practices and priorities, and ways to improve enterprise IT approaches to defend against web-borne malware, cited as the most rapidly growing enterprise data security threat. Among key findings: web-borne malware is likely to have infiltrated more than 75% of enterprises via inherently insecure browsers.

Ponemon surveyed 645 IT and IT security practitioners directly involved in their company's efforts to detect and contain malware at US businesses with an average of more than 14,000 employees.

"The findings of this research reveal that current solutions are not stopping the growth of web-borne malware," said Dr. Larry Ponemon, chairman and founder of Ponemon Institute. "Almost all IT practitioners in our study agree that their existing security tools are not capable of completely detecting web-borne malware and the insecure web browser is a primary attack vector. Further, the findings are evidence of the need for a more effective solution to stop web-borne malware."

Although all of the companies surveyed deploy a multi-layer, defense-in-depth security architecture, these organizations still experienced an average of 51 security breaches over the past 12 months. This is due to the failure of detection-based security technologies in preventing browser-borne malware. Findings reveal the average cost to respond to and remediate just one security breach resulting from failed malware detection technology to be approximately $62,000 per breach, exclusive of fraud-related costs and impact on valuation. Ponemon estimates that such attacks and infections have cost participating organizations an average of $3.2 million to remediate a security breach caused by web-borne malware.

Other Key Findings:

  • 69% of IT and security professionals that believe browser-borne malware is a more significant threat today than just 12 months ago, and is more serious than other types of malware infections;
  • 89% are certain or believe that their organization has been infected without detection (surprisingly, most believe such web malware prevention remains a low organizational priority); and
  • The vast majority of those surveyed cite insecure web browsers as a primary attack vector (81 percent strongly agree or agree), and that even with existing security tools, web-borne malware can be completely undetectable.

"While the Web browser has become the most strategically important application on corporate desktops, it is also, unfortunately, the most vulnerable application in terms of being a delivery channel for malware leading to cyber attacks," said Branden Spikes, CEO, CTO and founder, Spikes Security. "What many organizations forget is that the browser is the only application that is permitted to download and execute code from a 3rd party location -- any external web site. Every time you allow unknown code into your network, you put yourself and your business at risk. This is why browser isolation outside the network is so important. It is the only way to prevent this problem."

A reflection of today's current technologies uses to protect organizations, 74 percent of those surveyed strongly agree or agree that traditional detection-based technologies are becoming ineffective in stopping these attacks. Additionally, only 31 percent of respondents strongly agree or agree that commercial browsers contain effective security tools for blocking web-borne malware.

Detailed Survey Findings and Analysis

  • A barrier to the detection and containment of malware is a lack of resources. Seventy-seven percent of respondents say it is certain or very likely their organizations have been infected by web-borne malware that was undetected. According to 51 percent of respondents, they are not receiving the resources or budget they need to effectively detect and contain this threat and 49 percent of respondents say defending against web-borne malware is not a security priority. As a result, the majority of respondents (52 percent) rate their ability to detect and contain web-borne malware as very weak or weak.
  • Users' insecure web browsers cause the majority of total malware infections. The web browser is a common attack vector that can severely impact their organization's security posture. On average, a user's insecure web browser is the cause of 55 percent of the total malware infections.
  • Sandboxes and content analysis engines help, but do not solve the problem. Some 38 percent of respondents say web-borne malware was still able to bypass this solution. In addition, 50 percent say the web-borne malware was able to bypass their organization's layered firewall defense. Forty-six percent say the organization's anti-virus solution was not a deterrent and 41 percent say web-borne malware was able to bypass intrusion detection systems. This suggests that an effective solution is still required to ensure that no browser-borne malware is able to penetrate the network, breach desktop browsers or gain access to sensitive internal resources.
  • Organizations are willing to pay a premium to stop browser-borne malware. Organizations would allocate an average of 33 percent of their total security budget to stop web-borne attacks by 50 percent. To stop 100% of these attacks, they would allocate an average of 50 percent of the budget. The average annual IT security budget is approximately $7.8 million and 39 percent of the budget is spent on defense-and-depth security tools such as web gateways, IPS, anti-virus, which have proven to be ineffective.
  • Dependency on traditional detection methods deters organizations from adopting new solutions. Sixty-five percent of respondents say overcoming psychological dependency upon traditional detection methods would be a main barrier to adopting a browser isolation technique that rendered traditional web-borne malware detection and containment methods obsolete and unnecessary. This is followed by concerns over diminished user productivity (50 percent), system performance issues (44 percent) or complexity and difficulty to operate (41 percent).

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • Securing the Flow of Operations

    The transportation industry is a complex and dynamic environment where efficient management of physical keys, vehicles and shared devices is critical to ensuring smooth operations, reducing costs and maintaining security. Every day, more transportation facilities are using modern electronic key and asset management systems to better secure, audit and manage the important assets that keep operations running smoothly. Read Now

  • Today's Enterprise

    Protecting servers and data has evolved rapidly over the past 15-plus years. Early on, concerns centered around the environmental conditions of where servers were housed within a building and the effects of humidity, temperature and air quality on their performance. This led to a better understanding of the need for a controlled environment to maximize equipment lifespan and capacity. It was also a driving force behind consolidating servers in a common space, i.e., the data center. Read Now

  • Study Proves It: Security Awareness Training Reduces Phishing Attacks

    Attackers are increasingly targeting human-based vulnerabilities to infiltrate organizations. Humans have direct access to insider systems and data – any threat actor can easily phish users, steal their credentials and secure keys to the kingdom without having to fight advanced cybersecurity defenses. Studies show social engineering attacks and human errors are behind 68% of all breaches.  Read Now

Featured Cybersecurity

Webinars

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3