Digital Transformation Under Attack

As digital business models become business as usual, companies are rapidly moving applications and data to the cloud and deploying new technologies brought about by the Internet of Things (IoT). The problem: These moves come hand in glove with increasingly sophisticated DDoS attacks. Top targets for attackers include customer-facing applications, cloud services, and poorly protected IoT devices, according to the 15^th annual Worldwide Infrastructure Security Report (WISR), just released as part of NETSCOUT’s latest Threat Intelligence Report.

Key Concerns and Top Targets

Customer Threats. Two-thirds of enterprises (67 percent) indicated that DDoS attacks targeted customer-facing services and applications in 2019, while 52 percent saw attacks targeting their infrastructure. Both threats directly affect an organization’s ability to service customers, thus impacting its revenue and profitability.

Cloud. The cloud was also a big target. Enterprises faced attacks on third-party data center or cloud services (14 percent), while 9 percent saw SaaS services such as VPN, email, and transaction processing, under attack. And just as enterprise IT environments started their adoption of multiple cloud partners, attackers found a new target: Layer 7 applications. Top services targeted by application layer attacks included HTTPS (75 percent) HTTP (60 percent), DNS (46 percent), and email (35 percent).

IoT.  While IoT has brought about efficiency for enterprises, it comes with a price: a dramatically increased attack surface. IoT devices are often delivered with poor security or none at all, and patches are rarely made available for them. Enterprise IoT security measures being undertaken include periodic risk assessment, including vulnerability scanning, software patching and maintenance, micro-segmentation and zero-trust architectures, deployment of IoT security gateways, and proactive monitoring for DDoS from internal IoT devices.

Data Privacy. At 32 percent, accidental data loss topped the list of threats in 2019, and it remains a top concern for 2020, with 47 percent of respondents expressing concern. This makes sense, considering the myriad data privacy regulations in effect worldwide. In industries bound by such regulations, protecting data from any type of exposure is critical. Internet connectivity congestion due to genuine traffic growth was also a top threat, as indicated by 32 percent of respondents. An accidental major service outage rounded out the top three threats. After that, ransomware, malicious insiders, and distributed denial of service (DDoS) attacks remain top concerns for enterprises in 2020.

A Skills Shortage

Meanwhile, respondents reported a severe shortage of qualified security personnel available to staff enterprise security teams. In citing their most pressing cybersecurity challenges, 59 percent of enterprise and service provider respondents selected difficulty hiring and retaining skilled personnel (a number that keeps rising), while 48 percent said a lack of headcount or resources is a major pain point. As such, many enterprises are outsourcing their security strategy to managed security service providers, and 60 percent of service providers say they now offer some form of security services, up from 47 percent in 2018. Outsourced services include DDoS protection, firewall, access/VPN, IPS/IDS, and others.

Despite this dire outlook, enterprises have a real opportunity to improve their security and risk posture in 2020 and beyond. From very basic methods such as patching to more-advanced activities such as deploying visibility without borders or practicing incident response drills, enterprises have many tools at their disposal to protect their businesses.

Read the NETSCOUT Threat Intelligence Report to gain a better understanding of the evolving enterprise threat landscape.

Hildebrand is a senior strategic marketing writer at NETSCOUT.