SolarWinds MSP: Most Senior Security Executives Unprepared For Cyber Attacks

While most senior security executives agree that cyber attacks are increasing, it appears they remain unprepared to defend against them.

According to new research from SolarWinds MSP, more than half of those executives lack the means to face some of the biggest security threats.

The study, commissioned with the Ponemon Institute, looked specifically at threats propagated by the Vault 7 leaks and WannaCry and Petya ransomware attacks. It asked 202 senior-level security executives in the United States and United Kingdom about those emerging threats. Most of the respondents were confused about what threats pose the most risk and believe they lack the means to defend against them, according to the study’s authors. They also did not think their organizations could afford to deal with cybersecurity threats.

Only 45 percent said they had the technology to prevent, detect, and contain threats, while only 47 percent had enough budget to cope. Most of the executives were aware of the WannaCry and Petya threats, but only about 30 percent knew about the Vault 7 threats.

The study’s authors believe the number of attacks detected by businesses is potentially more worrying than the confusion over the risk. More than half of the respondents admitted their business had experienced an attack in the last year. Of those, nearly half had been unable to prevent the attack.

The result of these successful cyber attacks included:

The Threats

Vault 7 is a series of documents released by Wikileaks at the beginning of March purporting to document the spying operations and hacking tools of the Central Intelligence Agency. The leak demonstrated how the CIA could exploit vulnerabilities in unpatched iOS and Android operating systems, systems for compromising end-to0end encrypted chats, bugs in Windows, and even the ability to turn Samsung smart TVs into listening devices.

The Petya and Wannacry viruses became household names last year when a series of attacks targeted various government and banking organizations around the world.

Despite growing awareness of these threats, and the ability to remedy the problem, most people weren’t implementing these fixes. Slightly more than half of respondents didn’t patch for Petya while 44 percent of those who were aware of the WannaCry patch didn’t implement it.

The Service Provider Role

Ultimately, it seems that businesses do not feel prepared to prevent the attacks. More than a quarter said they would be unable to prevent a Petya or WannaCry attack. Only 9 percent say their ready to prevent exploits of Vault 7 threats like Dark Matter or After Midnight.

“The lack of knowledge among senior-level security executives is worrying—they know that attacks are on the increase, but many don’t know what they are and seem unable to effectively prevent them,” said Larry Ponemon, founder, Ponemon Institute.

Ponemon believes at least some of the fault lies with service providers who need to provide more education on where most attacks are coming from and how they can be prevented. It’s an idea that SolarWinds VP of security architecture Tim Brown, perhaps unsurprisingly, agreed with.

“It’s a bit like the wild west now, as we saw from the widespread fallout from WannaCry and Petya, and may still see from Vault 7 if those leaks are more widely exploited,” he says. “Indeed, we have no crystal ball to know what threats lie on the horizon. Businesses need help with everything from awareness to technology to specialized staff. This study supports a view that MSPs have a unique opportunity to expand their security offerings to meet this need by filling gaps that can’t be easily filled in house.”