eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
In any given week, there are typically multiple research reports and studies released by IT vendors that aim to provide interesting data points and insight into the latest trends.
The week of Feb. 5-9 there were at least six reports released, each with a different perspective on the changing face of both IT and cyber-security risks. Among the organizations that released reports were Javelin Strategy and Research, Bromium, Menlo Security, Infoblox, ThreatMetrix and PagerDuty.
In the aggregate, the reports show that threats continue to grow, alongside with the cost and complexity of detecting threats.
Identity Fraud
On Feb. 6 Javelin Strategy and Research released its 2018 Identity Fraud Study, reporting that there was a record high for identity fraud in the U.S. in 2017. According to the report, there were 16.7 million victims of identity fraud in 2017, up by 1.3 million from 2016. All that identity fraud carries a large cost, amounting to approximately $16.8 billion for the year.
“2017 was a runaway year for fraudsters, and with the amount of valid information they have on consumers, their attacks are just getting more complex,” Al Pascual, senior vice president, research director and head of fraud and security at Javelin Strategy and Research stated. “Fraudsters are growing more sophisticated in response to industry’s efforts to implement better security.”
One of the positive areas for fraud though in 2017 was the success of EMV based credit cards. According to Javelin Strategy and Research, online fraud is now more likely than in-store point-of-sale fraud due to EMV card adoption.
Security firm ThreatMetrix also reported an increase in cybercrime activity as part of its Q4 2017 Cybercrime report, that was released on Feb. 8. ThreatMetrix reported that in the fourth quarter of 2017 there was a 113 percent increase in cyberattacks on a year-over-year basis. Among the sources of the increased cyberattack traffic were over 800 million bot attacks that ThreatMetrix recorded.
Menlo Security released its 2017 State of the Web report on Feb. 5 revealing what it saw as sources of attack from across the web landscape. One of the primary culprits are organizations that continue to use older, unsupported software, including Microsoft’s Internet Information Services (IIS) version 7.5. Menlo Security also found that the top category of known bad websites that are used to make attacks or deliver malware, are adult and pornography-related sites.
Detection Costs
Organizations are not sitting idly by while hackers are taking aim at their infrastructure and users. However according to a Feb. 6 report from Bromium, some of the money being spent by enterprises to detect threats is being wasted. The Bromium report is based on a survey of 500 CISOs from around the world.
According to Bromium’s analysis, organizations spend $345,300 per year on detection-based security tools, including anti-virus and advanced threat detection technologies. The detection-based tools generate over one million alerts per year, of which 750,000 are false positives. To add further insult to injury, Bromium estimates that organizations are spending 413,920 hours per year triaging threat detection system alerts.
“It’s no surprise that 63 percent of the CISOs we surveyed said they’re worried about alert fatigue,” Gregory Webb, CEO of Bromium stated. “Our customers tell us their SOC (Security Operations Center) teams are drowning in alerts, many of which are false positives, and they are spending millions to address them.”
Threat Intelligence
Part of threat detection is threat intelligence, which is the subject of Infoblox’s third annual study on the state of threat intelligence exchange conducted by the Ponemon Institute, that was released on Feb. 7.
The report found 67 percent of IT and security professionals spend over 50 hours per week on threat investigations. When looking at the threat information they receive, 66 percent of of the study’s respondents reported that shared information is not timely, while 41 percent indicated that that the threat information shared is too complicated.
“Cybersecurity takes a village, and this survey spotlights a real need for the cybersecurity community and public sector to better cooperate and communicate to share intel on security threats,” Larry Ponemon, chairman and founder of the Ponemon Institute, stated. “More accurate and comprehensive exchange of threat intelligence will speed up our ability to respond to attacks and will result in stronger defense against cyber threats – whether that’s amongst enterprises or our nation’s critical infrastructure.”
Work-Life Balance
With all the threats facing IT professionals and the challenge of dealing with detection-based systems and complicated threat intelligence, it’s no wonder that work-life balance is a challenge.
On Feb. 7, PagerDuty released its State of IT Work-Life balance report, based on surveys of 800 IT professionals, providing insight into the human elements of IT organizations. According to the PagerDuty report, 49 percent of respondents in the U.S. had their personal life interrupted between 11 and 30 times a week by an IT-related issue.
All those interruptions are adversely impacting overall job performance and could be leading to staff attrition. PagerDuty reported that 23.1 percent of respondents indicated that they are more likely to look for a new job as a result of poor work-life balance.
So what does it all mean? Simply put, threats and cyberattackers aren’t going away they are only growing in number and volume of attacks. Simply attempting to scale existing process and spending more on threat detection alone isn’t enough. All the activity in IT operations is also leading to an erosion of the work-life balance for a lot of IT professionals.
Being and IT security professional in 2018 is certainly not an easy job.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.