First-ever Cyber security study by Wipro,  highlights  the problem  -- and signposts future challenges
Bangalore, June 19 2017: Wipro  has harnessed its wide global  presence to reach out to some 139 organizations in 11 countries to  evaluate  security practices and analyze thousands of attempted security attacks and incidents captured in  its own Cyber Defence Centres during 2016.
This has helped launch its first ever ‘State of Cybersecurity Report, 2017’ which highlights the trends in cybersecurity and imminent disruptions that can affect future trends.
The key finding: Last year saw an alarming 53.6% increase in the number of records stolen across the globe as opposed to 2015. Data breaches once made public, resulted immediately in high peaking of negative sentiments on social media against the enterprise concerned as expressed in  twitter. Some  56% of breaches reported had user credentials (passwords) as part of the types of data stolen, implying that further damage could  well be done,  using the stolen data.
Data analysis points out that 56% of all the malware attacks that took place in 2016 were a result of Trojans. Viruses and worms accounted for 19% and 20% respectively. Other types of malware like adware and ransomware, accounted for only 4% of attacks,  though they often can lead to significant damages.
Irony: IoT is the enemy!
And here's the irony:  Enterprises are forced by peer pressure to invest in  'sexy' new technologies like Internet of Things -- and increasingly,  Internet of Everything --  like connected cameras, cars, health and industrial automation devices. These have proved to be a great launch pad for the “hacking for hire” industry.  Why?
Because these emerging IoT devices come with a low memory and processing footprint and usually accommodate very little security capabilities including patching. Such devices, once “online” with an IP address, are easy prey for sophisticated hacking syndicates. These syndicates can develop custom malware to take control of IoT devices en masse and use them as a launch pad for cyber-attacks.
In this scary scenario, the responsibility for governance of data privacy is still highly centralized, Managing privileged access to data was ranked as the highest control amongst data security controls.
“Cyber security is becoming a top priority for businesses. It has become very critical to identify risks near real-time and empower stakeholders to take actions and decisions based on priority", says Sheetal Mehta, Vice President and Global Head, Cybersecurity & Risk Services, Wipro Limited.
The full State of Cybersecurity Report, 2017 in PDF can be found here
We have  scanned the 58 page document to bring you  some significant, some startling,  highlights  on the state of current defence mechanisms being deployed:
The user is still the real enemy. Teaching the lay user to not fall prey to social engineering or deceptive technical attacks has provided only incremental benefits in reducing cybersecurity incidents.
There is a downside to all this hype about the Cloud: The crown jewels have left the fortress . While Software as a Service ( SaaS)  adoption has made businesses nimble in the way they exploit and leverage IT, it has left the IT security teams chasing the data that has left the organizational shores. The centralized IT risk and security functions have been left considerably weakened and their ability to maintain control over sensitive data has been eroded.
Smart applications have become the soft underbelly.  The ‘app store’ culture is now very contemporary and businesses are enabling their ecosystem, including partners and consumers, to develop custom applications to solve common problems.  But  only 20% of the respondents said that they test their apps for vulnerabilities and eliminate them in every build.
Internet of Things will become the new cyber weapon.  Such devices, once they are ‘online’ with an IP address, are easy prey for sophisticated hacking syndicates.
Bring your own key (BYOK) will be a game changer for cloud data protection.  Once the data moves out of the enterprise periphery to the cloud environment, there is a loss of control particularly over what the privileged users of the cloud services provider can do with the data. BYOK  give  compliance and control to enterprises over their data wherein the enterprises could hold on to their keys and an agent housed with the cloud provider could provide the real-time encryption and decryption capability.
Future battles will be fought between bad bots and good bots . 46.8% of the organizations felt they lack skilled security analysts who can help improve both detection and containment.