Large businesses are the most vulnerable to cyber attacks

Password flaws, unsecured protocols and out-of-date software - enterprises have them all

Large enterprises are the least prepared of all companies against cyber crime, despite having greater budgets and resources, according to new research.

Contrary to received wisdom, larger companies performed the worst when assessed by cyber security consultancy firm Coalfire, in part due to their complex organisational structure and large attack surface built from multiple acquisitions.

Researchers' assumptions that SMBs would be the most at risk due to a lack of firm process and procedure, as well as staffing and budget weaknesses, were defied in Coalfire's first annual Penetration Risk Report, with midsized businesses hitting what the report dubbed a "cyber security sweet spot".

The report's findings, based on 310 penetrations tests across 148 organisations of various sizes, showed that while large enterprises are too diverse and complex to uniformly protect their entire architecture, midsized businesses provide the best configuration to best secure their environments.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Among all types of penetration tests conducted on large organisations, 49% of vulnerabilities found were deemed high risk, versus 38% for small businesses and 34% for medium businesses.

"Large organizations do not become large organizations entirely on their good looks and charm," the report said. "For many companies, growth is largely 'inorganic', achieved through mergers and acquisitions. As the asset collection grows, the attack surface grows.

"An acquiring company with its own asset management challenges often integrates other companies that come with their unique asset management challenges. When you mix poor asset management into a growing attack surface, you find the security posture will erode quickly, as it is inversely proportional to the growth of the attack surface."

Rapid change, shadow IT and employee turnover were all highlighted as factors that contributed to a "cyber-dynamic" environment within enterprises that is harder to control and get full visibility into, with internal networks considered the biggest vulnerability.

But while large organisations proved best at defending against phishing and other social engineering attacks, midsized businesses performed best at protecting their assets and mitigating their overall security risks.

"Our extensive penetration tests flip the thinking that large enterprises are the most secure, even with significant cyber security budgets and investments in staffing and other resources," said Andy Barratt, Coalfire's UK managing director.

Advertisement - Article continues below

"However, this doesn't apply to social engineering where large corporates are more secure. Despite bigger companies outperforming their smaller rivals in this area, it's clear that human error poses the greatest risk to businesses of all sizes. Whether you're a FTSE 100 company or an SMB, the chances are that staff are your cyber security Achilles' heel."

The researchers also found that internal networks showed higher risk factors than external networks - despite their presumption that internet-based attacks represented a greater threat - while human error was the weakest security link in an organisation, given the prevalence of phishing attacks.

Unsecured protocols, password flaws, missing system patches, out-of-date software and cross-site scripting, meanwhile, comprised the top five most common enterprise vulnerabilities in both external and internal networks. But phishing attacks were identified as the gateway for attackers to infiltrate an organisation on a deeper level.

Coalfire's researchers issued recommendations for organisations of all sizes to follow, including implementing two-factor authentication, expanding patch management beyond Windows Update, as well as maintaining an accurate inventory of systems and their dependencies.

Advertisement
Advertisement - Article continues below

Beyond general advice, small businesses were encouraged to integrate security checkpoints in engineering and development processes, while midsized business were urged to focus investment on mitigating human error, particularly in developing programmes to boost cyber security awareness, and engaging employees in social engineering testing.

The report recommended that large companies prioritise asset management, and focus on raising the level of visibility across the entire organisation, given the greater tendency for these companies to suffer from "technology sprawl and complex, decentralised operations".

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/digital-transformation/31168/four-ways-cios-can-drive-digital-transformation
digital transformation

Four ways CIOs can drive digital transformation

17 Jan 2020
Visit/strategy/28223/cio-job-description-what-does-a-cio-do
Business strategy

CIO job description: What does a CIO do?

7 Jan 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/hardware/354584/windows-10-and-the-tools-for-agile-working
Sponsored

Windows 10 and the tools for agile working

20 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020