SME horizon

VMware releases Singapore-focused cyber-security threat survey report

Photo by Dan Nelson

VMware, Inc. an innovator in enterprise software, has released the results of its third Singapore-focused cyber-security threat report entitled, “Extended Enterprise Under Threat,” based on a survey of 251 Singaporean CIOs, CTOs and CISOs.

The research found that the threat landscape appears to have plateaued and attack frequency and sophistication have lessened during the past 12 months in Singapore. However, this has still prompted continued investment in cyber-defence, with Singaporean businesses already using an average of more than eleven different cyber-security tools, the survey found.

Data for the report was compiled in March and April 2020 by an independent research company, Opinion Matters, on behalf of VMware Carbon Black.

Key survey findings from Singaporean respondents:

Third party breach risk on the rise in Singapore

The most common cause of breaches was identified as OS vulnerabilities (20%) but third-party application breaches account for 15% – more than double the impact they had last year, the survey found.  Island-hopping has more than tripled in attack frequency and is now the most commonly experienced attack for 10% of Singaporean respondents and it has caused 12% of breaches, the survey found.

Rick McElroy, Cyber Security Strategist at VMware Carbon Black, said: “Island-hopping is having an increasing breach impact with 12% of survey respondents citing it as the main cause. In combination with other third-party risks such as third-party apps and the supply chain, it’s clear the extended enterprise is under pressure.”    

Complex multi-technology environments

Singaporean cyber-security professionals said they are using an average of more than eleven different tools or consoles to manage their cyber-defence program, the survey found. This indicates a security environment that has evolved reactively as security tools have been adopted to tackle emerging threats. Said McElroy: “Siloed, hard-to-manage environments hand the advantage to attackers from the start. Evidence shows that attackers have the upper hand when security is not an intrinsic feature of the environment. As the cyber threat landscape reaches saturation, it is time for rationalization, strategic thinking and clarity over security deployment.”

Supplemental COVID-19 survey in Singapore

The latest research was supplemented with a survey on the impact COVID-19 has had on the attack landscape. According to the supplemental survey of more than 1,000 respondents from the U.S., UK, Singapore and Italy, 93% of Singaporean cyber-security professionals said attack volumes have increased as more employees work from home. 90% said their organizations have experienced cyber-attacks linked to COVID-19 malware.

Key findings from the supplemental Singapore COVID-19-focused survey:

Said McElroy: “The global situation with COVID-19 has put the spotlight on business resilience and disaster recovery planning. Those organizations that have delayed implementing multi-factor authentication appear to be facing challenges, as 32% of Singaporean respondents say the inability to implement MFA is the biggest threat to business resilience they are facing right now.”

Singaporean survey respondents were asked whether COVID-19 had exposed gaps in their disaster recovery plans, and to indicate the severity of those gaps. Their responses showed that:

Said McElroy: “These figures indicate that the surveyed CISOs may be facing difficulty in a number of areas when answering the demands placed on them by the COVID-19 situation.”

Risks directly related to COVID-19 have also quickly emerged, the survey found. This includes rises in COVID-19 malware, phishing, spear phishing and IoT exposure which were all seen by 90% of Singaporean respondents.

Said McElroy: “The 2020 survey results suggest that security teams must be working in tandem with business leaders to shift the balance of power from attackers to defenders. We must also collaborate with IT teams and work to remove the complexity that’s weighing down the current model. By building security intrinsically into the fabric of the enterprise – across applications, clouds and devices – teams can significantly reduce the attack surface, gain greater visibility into threats, and understand where security vulnerabilities exist.”

Exit mobile version