Canadian Security Magazine

COVID-19 Updates News Data Security
Cyber attacks have increased in past 12 months for 99 per cent of Canadian organizations: survey

Global COVID-19 surge adding new elements to threat environment


VMware, Inc. released the results of its third Canada-focused cybersecurity threat report, entitled, “Extended Enterprise Under Threat,” based on a survey of 251 Canadian CIOs, CTOs and CISOs.

The research found an increased in both cyberattack volume and breaches during the past 12 months in Canada. This has prompted increased investment in cyber defense, with Canadian businesses using an average of more than nine different cybersecurity tools, the survey found.

Key survey findings from Canadian respondents:

  • 99 per cent said attack volume has increased during the past 12 months, the survey found.
  • 100 per cent said their business has suffered a security breach in the last 12 months. The average organization said they experienced 1.1 breaches during this time, the survey found.
  • 86per cent said attacks have become more sophisticated, the survey found.
  • 98per cent said they plan to increase cyber defense spending in the coming year, according to the survey
  • Web application attacks and OS vulnerabilities were the leading cause of breaches, according to the survey, followed by third party application attacks.
  • Canadian companies said they are using an average of 9 different security technologies to manage their security program, the survey found.

Supply chain risk in Canada

Advertisment

Despite only being cited by 2 per cent of respondents as the most common attack type experienced, island-hopping was the cause of 10 per cent of breaches, the survey found, as the attack vectors in the supply chain prove an easy target for hackers.  Third-Party application attacks were also high as a breach cause, at the root of 13 per cent according to those surveyed.

Rick McElroy, cyber security strategist at VMware Carbon Black, said in a statement: “Island-hopping is having an increasing breach impact with 10 per cent of survey respondents citing it as the main cause. In combination with other third-party risks such as third-party apps and the supply chain, it’s clear the extended enterprise is under pressure.”    

Complex multi-technology environments

Canadian cybersecurity professionals said they are using an average of more than nine different tools or consoles to manage their cyber defense program, the survey found. This indicates a security environment that has evolved reactively as security tools have been adopted to tackle emerging threats.

Said McElroy: “Siloed, hard-to-manage environments hand the advantage to attackers from the start. Evidence shows that attackers have the upper hand when security is not an intrinsic feature of the environment. As the cyber threat landscape reaches saturation, it is time for rationalization, strategic thinking and clarity over security deployment.”

Supplemental COVID-19 survey

The latest research was supplemented with a survey on the impact COVID-19 has had on the attack landscape. According to the supplemental survey of more than 1,000 respondents from the US, UK, Singapore and Italy, 91 per cent of cybersecurity professionals said attack volumes have increased as more employees work from home. 92 per cent said their organizations have experienced cyberattacks linked to COVID-19 malware.

Key findings from the supplemental COVID-19-focused survey:

  • 92 per cent said they have been targeted by COVID-19-related malware; 89 per cent said IoT exposure risk has increased.
  • Inability to institute multifactor authentication (MFA) was reported as the biggest security threat to businesses during COVID-19, the survey found.
  • 84 per cent reported gaps in disaster planning around communications with external parties including customers, prospects, and partners. 48 per cent said those gaps were significant.

Said McElroy: “The global situation with COVID-19 has put the spotlight on business resilience and disaster recovery planning. Those organizations that have delayed implementing multi-factor authentication appear to be facing challenges, as 29% of global respondents say the inability to implement MFA is the biggest threat to business resilience they are facing right now.”

Survey respondents were asked whether COVID-19 had exposed gaps in their disaster recovery plans, and to indicate the severity of those gaps. Their responses showed that:

  • 88 per cent of respondents reported gaps in recovery planning, ranging from slight to severe.
  • 87 per cent said they had uncovered gaps in IT operations.
  • 85 per cent said they encountered problems around enabling a remote workforce.
  • 78 per cent said they’ve experienced challenges communicating with employees
  • 84 per cent said they had experienced difficulty communicating with external parties.
  • 70 per cent said the situation uncovered gaps around visibility into cybersecurity threats.

Said McElroy: “These figures indicate that the surveyed CISOs may be facing difficulty in a number of areas when answering the demands placed on them by the COVID-19 situation.”

Risks directly related to COVID-19 have also quickly emerged, the survey found. In addition to the 92 per cent of respondents who said they experienced an increase in COVID-19-related malware, 89 per cent reported increased IoT exposure, 89 per cent said they had witnessed increased phishing attacks, and 88 per cent had seen more attempts at spear phishing since COVID-19 began.