Many businesses globally are failing to acknowledge surging cyber security threats, according to new research, despite attempted cyber attacks skyrocketing over the last 12 months.
Analysis from cyber security firm Armis found that attack attempts more than doubled across 2023. Attacks on utilities, the study found, tripled, while attacks on manufacturing rose by 165%.
Attack attempts peaked in July, according to Armis, with communications devices, imaging devices, and manufacturing devices especially targeted during this period.
However, despite growing threats, many companies may not be taking the danger seriously enough, the security firm warned.
The study specifically noted that organizations are frequently overlooking “blind spots” within their digital infrastructure, which is causing a surge in critical vulnerabilities and breaches.
"Armis found that not only are attack attempts increasing, but cyber security blind spots and critical vulnerabilities are worsening, painting prime targets for malicious actors," said Nadir Izrael, CTO and co-founder of Armis.
"It’s critical that security teams leverage similar intelligence defensively so that they know where to prioritize efforts and fill these gaps to mitigate risk."
Legacy systems remain a key target for threat actors
The report found that legacy technology is giving security pros an increasingly uphill battle. Older Windows server OS versions - 2012 and earlier - were found to be 77% more likely to experience attack attempts than newer versions.
Vulnerabilities within server environments were also a key focal point for Armis, which found that nearly one-quarter of server versions are reaching end-of-support, and therefore more likely to be in the crosshairs for threat actors.
Educational Services are most vulnerable here, with 18% or organizations facing end-of-support or end-of-life issues. Analysis showed organizations in this sector had a significantly higher percentage of servers with unpatched vulnerabilities (41%) compared with a general average of 10%.
Other industries still using end-of-life or end-of-service OS’ that are no longer actively supported by the manufacturer are the retail trade at 14%, healthcare at 12%, manufacturing at 11%, and public administration at 10%.
Discover why security teams need to adopt a responsible approach to AI
DOWNLOAD NOW
Across 2023, more than 65,000 unique CVEs were discovered, Armis found, with wearable devices having the highest percentage of unpatched CVEs, at 93%.
Notably, the study showed that one-third of all devices still aren't patched for Log4Shell - and lots of other CVEs are being neglected too.
There's an 11% patch rate for low-severity CVEs, 58% for medium-severity and 64% for high-severity - but only 55% for those rated critical.
Overall, irrespective of the weaponization status of a CVE, organizations consistently grapple with patch rates at 62% for non-weaponized and 61% for weaponized vulnerabilities. With poor patch management, firms put themselves at risk.
"Blueprints like this report are invaluable as they help teams focus limited resources on efforts with the greatest impact and with the insights to tell data-driven stories in justification of cross-team priorities," said Armis CISO Curtis Simpson.
"Using hindsight and analyzed data could allow CISOs to focus 2024 efforts on segmenting legacy technology, prioritizing exposures of greatest significance."
