More than three-quarters (88%) of hackers can break through cybersecurity defences and into the systems they target within 12 hours, while 81% say they can identify and take valuable data within another 12 hours, even though the breach may not be discovered for hundreds of days, according to research by Australian technology company Nuix.
The Nuix Black Report—the results of a confidential survey of 70 professional hackers and penetration testers at DEFCON, the world’s largest hacking and security conference — will overturn many conventional understandings and sacred cows of the cybersecurity industry.
“There is no shortage of cybersecurity industry reports so we’ve avoided going down the familiar path of compiling data about incidents that have already taken place or highlighting trends and patterns in data breaches—these are clearly the symptoms of a deeper problem,” said Chris Pogue, Nuix’s Chief Information Security Officer and a co-author of the Nuix Black Report. “Instead, we have focused on the source of the threat landscape: the attackers themselves.”
By examining the security landscape from the hacker’s perspective, the Nuix Black Report has revealed results that are contrary to the conventional understanding of cybersecurity. For example:
- Respondents said traditional countermeasures such as firewalls and antivirus almost never slowed them down but endpoint security technologies were more effective at stopping attacks
- More than half of respondents changed their methodologies with every target, severely limiting the effectiveness of security defenses based on known files and attacks
- Around one-third of attackers said their target organisations never detected their activities.
“Data breaches take an average of 250–300 days to detect—if they’re detected at all—but most attackers tell us they can break in and steal the target data within 24 hours,” said Pogue. “Organisations need to get much better at detecting and remediating breaches using a combination of people and technology.”
Nuix Insight Adaptive Security is a next-generation endpoint technology with cutting-edge detection algorithms that can identify and stop security threats—including new and unknown attack methodologies—within seconds. According to industry analyst firm Enterprise Management Associates, Nuix Insight Adaptive Security “has applied practical field knowledge to the product’s development, leveraging a design team that includes malware analysts, penetration testers, incident response experts, social engineers, and digital forensic professionals” and “is well aligned with all of the top use cases for adaptive security technology.”[1]
“The Nuix Black Report illuminates the true nexus between attacker methodology and defensive posture; showing which countermeasures will improve security and which are a waste of money and resources,” said Pogue. “Readers will learn what is the best spend for their security dollar and, more critically, why.”
[1] Enterprise Management Associates, Nuix Insight Adaptive Security Brings Context Visibility and Deception to Protect Endpoints, January 2017
