Organisations need to improve their attack detection

The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 notable cyber intrusion cases, spanning a multitude of industries, that CrowdStrike Services engaged on during the past year.

The Casebook provides a detailed look at distinct IR use cases to offer trends in adversary behavior, motivation, and tactics, as well as response scenarios. It provides an all-encompassing investigative analysis of specific cases, dives into forensic artifacts uncovered in multiple instances referencing the MITRE ATT&CK™ framework, and offers best practices for organizations looking to improve cyber defenses.

Some key findings include:

●        Organizations are not making substantive progress to detect intruders and stop breaches overall. This year, 75 percent of the organizations CrowdStrike engaged with were able to internally detect a breach. This represents merely a 7 percent increase over the prior year’s findings, indicating that organizations have only slightly improved their ability to detect breaches. Dwell time also remained relatively the same at an average of 85 days compared to 86 in 2017. This statistic reflects the number of days between the first evidence of a compromise and its initial detection.

●        Commodity malware was often observed as a precursor to larger, more disruptive attacks. An organization’s susceptibility to commodity malware is also an indicator of the effectiveness of their entire security strategy: If their systems can be compromised with commodity malware, then what could a more sophisticated attacker do?

●        There was a dramatic rise in the number of attacks that leveraged social engineering and phishing. Across the IR cases observed, the CrowdStrike team observed a dramatic increase in the number of attacks leveraging social engineering, phishing and spear-phishing, jumping from 11 percent in 2017 to 33 percent in 2018. This accounted for one-third of all attacks investigated by CrowdStrike Services. Web server attacks comprised the biggest single attack vector, but showed a decline from the 37 percent noted last year to 19.7 percent. 

“Cyber-related attacks continue to proliferate as eCrime actors and nation-states ramp up their sophistication. It’s absolutely critical that today’s businesses are aware of emerging attack trends and adversary motivations in order to implement a more proactive stance to cybersecurity,” said Shawn Henry, chief security officer and president of CrowdStrike Services. “It is not a question of if you will be targeted, because it will happen to everyone. This is a business risk, and Boards of Directors and the C-Suite need to have a sense of urgency to protect their organizations’ viability. The CrowdStrike Services Casebook contains indispensable content that provides valuable insights into proactively preparing for security incidents and responding efficiently in the wake of an attack.”