September 29, 2017 |

F-Secure reveals the top two ways most companies get breached

With its unique web topology mapping feature, F-Secure Radar does what other vulnerability management tools won’t: It helps admins discover their full attack surface, internal and external. Buckinghamshire, UK – 24th May 2017: Companies are always looking for the new technology that will protect them from cyber attacks. Yet, F-Secure experts say that most companies […]

With its unique web topology mapping feature, F-Secure Radar does what other vulnerability management tools won’t: It helps admins discover their full attack surface, internal and external.

Buckinghamshire, UK – 24th May 2017: Companies are always looking for the new technology that will protect them from cyber attacks. Yet, F-Secure experts say that most companies get breached through one of two ways. And neither have anything to do with zero day vulnerabilities, which, they say, receive much more attention than they’re due.

 

“From our investigations, we know that most companies fall victim to attackers either because of unpatched software with known vulnerabilities, or because of the human factor, for example people falling victim to phishing emails,” says Janne Kauhanen, cyber security expert at F-Secure. Kauhanen says in essence, all other security measures are just secondary measures designed to catch attacks that happen because of these two reasons. “And still, companies are fixated on zero days and the newest methods of attack, which are often fairly restricted and obscure.”

 

A new security vulnerability is identified every 90 minutes*, and several thousands of vulnerabilities are disclosed every year. On average, it takes 103 days for a vulnerability to be remediated*. In contrast, according to Gartner, “the time it has taken from a patch coming out to when an exploit appears in the wild has dropped from 45 days to 15 days during the past decade.” Gartner notes that, “on average, vulnerabilities that are exploited at day zero (AKA with no knowledge of the vendor or no prior remediation being available) are about 0.4% of total vulnerabilities each year during the past decade.”**

 

The massive WannaCry crypto-ransomware outbreak is the most recent example of a known vulnerability being exploited to great effect. The outbreak, which has infected systems in dozens of countries and impacted a wide range of sectors (including transportation and health services) is based on a Windows Server Message Block (SMB) vulnerability, MS17-010, that had been patched by Microsoft in March. The spread of the worm would have been reduced had more systems been kept up to date. Telemetry from F-Secure’s vulnerability management tool, Radar, indicates that 15 per cent of hosts run Windows SMB. The WannaCry outbreak dramatically illustrates why admins should make sure SMB is properly patched and is not exposed to the public Internet.

 

You can’t fix what you don’t know about

 

“The best way to handle cyber threats is to actually foresee them by fixing vulnerabilities before they can even be exploited,” says Jimmy Ruokolainen, vice president, Product Management at F-Secure. “This means hardening an organisation’s entire attack surface. But with shadow IT, external misconfigurations and potentially vulnerable partners, companies aren’t usually aware of their entire attack surface. That’s where F-Secure Radar goes further than other vulnerability management solutions, with our unique web topology mapping feature.”

 

Threat assessment tools work well for finding vulnerabilities and exposed systems, as long as they are directed where to look. They don’t work as well for finding all the systems they’re meant to be examining, however. Web topology is the arrangement of a network, including its nodes and connecting lines. With F-Secure Radar, information security managers can generate a threat assessment report of their organisation’s internet and web topology and discover extraneous, vulnerable or misconfigured systems, such as internet-exposed SMB. It even allows visibility into external brand infringements on the web.

 

F-Secure Radar is a turnkey vulnerability scanning and management platform. It allows admins to identify and manage both internal and external threats, report risks and be compliant with current and future regulations  (such as PCI and GDPR compliance). It enables streamlined productivity and security management, with an efficient service workflow, including vulnerability monitoring, automated scheduled scans and ticketing for prioritised remediation and verification.

 

“The exploitation of known vulnerabilities is still the root cause of most breaches,” says Ruokolainen. “With F-Secure Radar, companies’ security teams can gain incomparable visibility and foresight into cyber security risks, so they can find exploitable vulnerabilities before anyone else does.”

 

*Source: Nopsec, 2016 Outlook: Vulnerability Risk Management and Remediation Trends

**Source: Gartner, It’s Time to Align Your Vulnerability Management Priorities With the Biggest Threats, Craig Lawson, 9 Sept 2016

 

-ends-

 

More Information

F-Secure Radar

 

 

About F-Secure

Nobody knows cyber security like F-Secure. For three decades, F-Secure has driven innovations in cyber security, defending tens of thousands of companies and millions of people. With unsurpassed experience in endpoint protection as well as detection and response, F-Secure shields enterprises and consumers against everything from advanced cyber attacks and data breaches to widespread ransomware infections. F-Secure’s sophisticated technology combines the power of machine learning with the human expertise of its world-renowned security labs for a singular approach called Live Security. F-Secure’s security experts have participated in more European cyber crime scene investigations than any other company in the market, and its products are sold all over the world by over 200 broadband and mobile operators and thousands of resellers.

 

Founded in 1988, F-Secure is listed on the NASDAQ OMX Helsinki Ltd.

 

f-secure.com twitter.com/fsecureukteam | facebook.com/f-secure

F-Secure media relations 

Geoff Dorrington

PR manager, F-Secure UK & Ireland

E: geoff.dorrington@f-secure.com

T: 01753 376592

 

 ###

 

Latest Events
Press Archives
Select Year

Latest Press Releases

November 16, 2017

DNS now your First Line of Defense against Cyber Attacks

F-Secure is partnering with the Global Cyber Alliance to step up the fight against malicious URLs with a secure DNS service that companies and individuals can use for free. Buckinghamshire, UK  – November 16, 2017: Every single day, F-Secure Labs discovers nearly 30,000 malicious URLs used in phishing attacks, ransomware campaigns, and other cyber attacks. […]

October 25, 2017

Study Shows 30% of CEOs Have Been “Pwned,” Passwords Exposed

Email exposure study also shows 81% of the world’s top CEOs have had their personal information exposed in spam lists or leaked marketing databases. Buckinghamshire, UK – October 25, 2017: Nearly one in three major CEOs has been “pwned” using their company email address, according to a new F-Secure study of CEO email exposure. In […]

October 10, 2017

F-Secure, University of Helsinki bring back Cyber Security Base

F-Secure and the University of Helsinki re-launch their cyber security MOOC following the success of last year’s offering. Buckinghamshire, UK – October 3, 2017: Cyber Security Base with F-Secure, an online course series developed by the University of Helsinki and F-Secure, is back for another year. Over 50,000 people from the United States, Finland, the […]

September 29, 2017

F-Secure wins AV-TEST Best Protection award for fifth time

Award reaffirms that companies which choose F-Secure’s new version of Business Suite will have proven best protection. Berkshire, UK – 1st February 2017: F-Secure has won the Best Protection award from the AV-TEST Institute for superior protection technology throughout 2016. The win makes F-Secure a five-time winner of the award and it’s the only company […]

%d bloggers like this: