SAN FRANCISCO, RSA Conference 2019 — mars 5, 2019 —

 Sophos (LSE: SOPH), a global leader in network and endpoint security, today announced the findings of its global survey, 7 Uncomfortable Truths of Endpoint Security, which reveals that IT managers are more likely to catch cybercriminals on their organization’s servers and networks than anywhere else. In fact, IT managers discovered 37 percent of their most significant cyberattacks on their organization’s servers and 37 percent on its networks. Only 17 percent were discovered on endpoints and 10 percent were found on mobile devices. The survey polled more than 3,100 IT decision makers from mid-sized businesses in 12 countries including the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa.

“Servers store financial, employee, proprietary, and other sensitive data, and with stricter laws like GDPR that require organizations to report data breaches, server security stakes are at an all-time high. It makes sense that IT managers are focused on protecting business-critical servers and stopping attackers from getting on the network in the first place and this leads to more cybercriminal detections in these two areas,” said Chester Wisniewski, principal research scientist, Sophos. “However, IT managers can’t ignore endpoints because most cyberattacks start there, yet a higher than expected amount of IT managers still can’t identify how threats are getting into the system and when.”

Twenty percent of IT managers who were victim to one or more cyberattacks last year can’t pinpoint how the attackers gained entry, and 17 percent don’t know how long the threat was in the environment before it was detected, according to the survey. To improve this lack of visibility, IT managers need endpoint detection and response (EDR) technology that exposes threat starting points and the digital footprints of attackers moving laterally through a network.

“If IT managers don’t know the origin or movement of an attack, then they can’t minimize risk and interrupt the attack chain to prevent further infiltration,” said Wisniewski. “EDR helps IT managers identify risk and put a process in place for organizations at both ends of the security maturity model. If IT is more focused on detection, EDR can more quickly find, block and remediate; if IT is still building up a security foundation, EDR is an integral piece that provides much needed threat intelligence.”

On average, organizations that investigate one or more potential security incidents each month spend 48 days a year (four days a month) investigating them, according to the survey. It comes as no surprise that IT managers ranked identification of suspicious events (27 percent), alert management (18 percent) and prioritization of suspicious events (13 percent) as the top three features they need from EDR solutions to reduce the time taken to identify and respond to security alerts.

“Most spray and pray cyberattacks can be stopped within seconds at the endpoints without causing alarm. Persistent attackers, including those executing targeted ransomware like SamSam, take the time they need to breach a system by finding poorly chosen, guessable passwords on remotely assessible systems (RDP, VNC, VPN, etc.), establish a foothold and quietly move around until the damage is done,” said Wisniewski. “If IT managers have defense-in-depth with EDR, they can also investigate an incident more quickly and use the resulting threat intelligence to help find the same infection across an estate. Once cybercriminals know certain types of attacks work, they typically replicate them within organizations. Uncovering and blocking attack patterns would help reduce the number of days IT managers spend investigating potential incidents.”

Fifty-seven percent of respondents said they were planning to implement an EDR solution within the next 12 months. Having EDR also helps address a skills gap. Eighty percent of IT managers wish they had a stronger team in place, according to the survey. More information is available in the 7 Uncomfortable Truths of Endpoint Security PDF and on Sophos News.

The7 Uncomfortable Truths of Endpoint Security survey was conducted by Vanson Bourne, an independent specialist in market research, in December 2018 and January 2019. This survey interviewed 3,100 IT decision makers in 12 countries and across six continents, in the US, Canada, Mexico, Colombia, Brazil, UK, France, Germany, Australia, Japan, India, and South Africa. All respondents were from organizations with between 100 and 5,000 employees.

Sophos is at SPiN during RSA Conference 2019 on March 5 and 6. For more information, please visit Sophoscom/spin. Additional information for media covering RSA is available on Sophos’ Press Page.

À propos de Sophos

Sophos est un leader mondial et un innovateur dans le domaine des solutions de cybersécurité avancées, qui comprend des services managés de détection et réponse (MDR) et de réponse aux incidents, ainsi qu’un vaste portefeuille de technologies de sécurité qui protègent les systèmes endpoint, les réseaux, les messageries et le Cloud contre les cyberattaques. Sophos est l’un des plus grands fournisseurs de cybersécurité et protège aujourd’hui plus de 500 000 entreprises et plus de 100 millions d’utilisateurs dans le monde contre les adversaires actifs, les ransomwares, le phishing, les malwares, etc. Les services et produits de Sophos sont connectés à travers sa console d’administration Sophos Central basée dans le Cloud et sont alimentés par Sophos X-Ops, l’unité de renseignement sur les menaces transversale de la société. L’intelligence de Sophos X-Ops optimise l’ensemble de l’écosystème de cybersécurité adaptatif (ACE) de Sophos, qui comprend un datalake centralisé exploitant un ensemble riche d’API ouvertes à destination des clients, des partenaires, des développeurs et des autres fournisseurs de cybersécurité et de technologies de l’information. Sophos fournit des services de cybersécurité aux entreprises qui ont besoin de solutions de sécurité clés en main et entièrement gérées. Les clients peuvent également gérer leur cybersécurité directement avec la plateforme d’opérations de sécurité de Sophos ou utiliser une approche hybride en complétant leurs équipes internes avec les services de Sophos, notamment la chasse aux menaces et la remédiation. Sophos vend ses produits par l’intermédiaire d’un réseau mondial de partenaires et de fournisseurs de services gérés (MSP : Managed Service Provider). Le siège de l’entreprise est basé à Oxford, au Royaume-Uni. Plus d’informations sont disponibles sur www.sophos.fr.