​Accenture finds cocky infosec execs miss three targeted attacks each month

Are you confident in your abilities to secure the corporate network? You shouldn’t be, according to consultancy firm Accenture.

The company’s survey of 2,000 cyber security pros tasked with protecting businesses with sales over $1bn a year across 15 countries, including Australia, found that about a third of targeted attacks resulted in a breach.

Accenture estimates that firms are exposed to two to three breaches per month, yet found that 75 percent of security executives believed their chosen strategy could protect their employer from cyber attacks.

“One in three focused attacks results in a breach; internal attacks have a major impact; and security teams admit they lack the necessary tools to detect breaches (and, in a third of cases, don’t discover the breaches at all)," Accenture reports.

"Nevertheless, three out of four respondents express confidence in their abilities to protect their organizations from cyber attacks. Not only that, 70 percent say that their organizations have completely embedded cybersecurity into their cultures and that it is a board-level concern supported by their top executives.”

However, fewer security execs in Australia harbor illusions about their capabilities. According to Accenture, organizations in Australia, France and the US are the least confident in their ability to detect a breach. On the other hand, it found that organizations in Australia allocated just 7.6 of their IT budget to cyber security, which was the lowest in the study behind US organizations, which allocated 8 percent.

The report arrived as Microsoft revealed a Windows zero-day flaw was used by Kremlin-backed hackers in targeted attacks. Though targets were typically government agencies and diplomatic institutions, they also included private sector defense contractors.

The hacking group, sometimes called Fancy Bear, is believed to have behind the breach of the Democratic National Committee. It also known to have used multiple software flaws in Adobe Flash, Windows and Java that organizations couldn’t patch before they were attacked.

Sophisticated attacks by nation-state backed hackers though are relatively rare compared to the thousands or millions of attempts to breach corporate networks each week. Still, some get through.

About half of the security pros surveyed said it took months to detect a breach, and 17 percent said it took a year or longer. Internal security teams discovered 65 percent of breaches, while the remainder were reported by employees, law enforcement and external security researchers.

While much attention is paid to the threat of external attackers, 50 percent of respondents said a breach by an insider had the greatest impact on the organization. Respondents were less confident about their ability to monitor insiders, with two thirds saying they weren’t sure about the effectiveness of systems used to monitor internal malfeasance.