Cyber Security Cloud released a research report on the period of time between the occurrence of a cyber-attack and its discovery and disclosure
Cyber Security Cloud released a research report on the period of time between the occurrence of a cyber-attack, its discovery, and disclosure. According to the study, cyber-attacks linked to personal data breaches take more than a year from occurrence to discovery on average.
TOKYO, Aug. 19, 2020 /PRNewswire-PRWeb/ -- Cyber Security Cloud, Inc. released a research report on the period of time between the occurrence of a cyber-attack and its discovery and disclosure, based on the major personal information breach incidents of more than 1,000 cases of unauthorized access at corporations and organizations that were announced between January 1, 2019 and July 31, 2020. According to the study, cyber-attacks linked to personal data breaches take more than a year from occurrence to discovery on average.
A survey of personal data breaches during the period under review revealed that, on average, it took about 383 days from the occurrence of the attack to its detection, and that companies and organizations were unaware of the cyber-attacks that led to personal data breaches for more than a year. Furthermore, it took an average of 69 days from the time the cyber-attack was discovered to the time it was made public, and in total, it took an average of 452 days from the time it occurred to the time it was made public.
In addition, a comparison of the number of days from the time of the attack to the time of discovery shows that 24 cases were discovered within 30 days of the occurrence, accounting for 41% of the total number of cases, followed by 14 cases (17%) in which it took more than one year and 9 cases (11%) in which it took between 180 days to 1 year. In total, more than 50% of the cases took longer than 90 days to be detected. In addition, of the cases that took more than one year before the attack was detected, nine cases took more than three years, and some cases took nearly 10 years.
Furthermore, a comparison of the time period between the discovery of the attack and its public disclosure shows that about 50% of the cases were disclosed within 30 days from the discovery of the attack, while more than 30% of the cases took more than 90 days. In some cases, it took more than a year to make it public. Such a long delay not only makes the affected company or organization responsible for the leak of personal information but also leads to further loss of trust.
Comment from Mr. Yoji Watanabe, CTO of Cyber Security Cloud, Inc.
One of the reasons why it takes a long time to discover a cyber-attack is that there is a long incubation period between the attack and the leak of information, and the leak is reported after the attack. In addition, the average time between discovery and disclosure was more than two months, suggesting that in these cases, in addition to the simple delay in disclosure, the detailed investigation of the damage took longer to complete.
In addition, a review of the first half of the fiscal year 2020 attack detection report conducted by CSC in July showed that cyber-attacks increased by nearly 20% during the period when a state of emergency was declared in Japan due to the global pandemic, compared to the period before it was issued. This is probably due to an increase in the number of users of web services, the introduction of corporate telework, and the concentrated targeting of periods when offices were stretched thin due to long vacations. In these times, when offices are short on resources, the number of attacks is likely to increase, and if an attack occurs, it will take longer to be detected, so it is important to be even more careful and take countermeasures.
The results of the survey suggest that there are many cases of attacks that have not yet been discovered or made public, and there is a possibility that the number of such cases will increase significantly. In order to prevent such a situation from happening, it is necessary to review your company's cybersecurity system.
Survey Summary
- Survey Period: January 1, 2019 - July 31, 2020
- Survey Target: Incidents of personal data breach involving more than 1,000 cases of unauthorized access that were announced in the above period (Total 81 cases)
- Survey method: Conducted by Cyber Security Cloud, Inc.
About Cyber Security Cloud, Inc.
With an aim to create a secure cyberspace that people around the world can use safely, Cyber Security Cloud provides web application security services worldwide using the world's leading cyber threat intelligence and AI technology. CSC is also certified as the 7th AWS WAF Managed Rules Seller in the world by AWS (Amazon Web Service) which boasts a 47.8%* global cloud market share.
As a leading cybersecurity company, CSC plans to continue to strive to improve and develop new technologies and aim to be a company that can deliver effective security solutions to contribute to the information revolution.
For more information, please visit https://www.cscloud.co.jp/en/
*: Gartner (July 2019)･･･Worldwide Iaas Public Cloud Services Market Share, 2017-2018 (Millions of U.S. Dollars)
SOURCE Cyber Security Cloud, Inc.
Share this article