igor - Fotolia

News

UK sales teams are the most exposed to cyber attacks, study reveals

UK sales staff, callcentre agents and customer services teams are among the most highly targeted by cyber attacks, yet few firms give these groups IT security training, a study shows

Warwick Ashford
By
Published: 10 Jul 2015 14:00

Companies are underestimating the risk of failing to provide security training to non-technical staff, even though they are the most likely to be targeted by attackers, a study by Intel Security has revealed.

The study, based on a survey of 300 European IT decisions makers, shows that in UK firms, sales staff are the most exposed to online attacks.

This is due to their frequent online contact with people outside their organisations, according to the study report entitled Dissecting the top five network attack methods: a thief’s perspective.

The next most highly exposed UK employees are callcentre and customer services teams, with both departments at more risk from a cyber attack than the company chief technology officer.

Intel Security said the risk of untrained employees clicking on dangerous links to unleash attacks on their organisation is rising, with the number of suspicious links soaring by 87% between 2013 and 2014.

However, the study shows that 51% of UK companies do not provide sales staff with IT security training, 52% do not provide training for customer service teams, and 60% fail to train receptionists and other front of house staff.

The study also revealed that more than 10% of UK firms polled do not provide mandatory security training to any of their staff, which is the highest across Europe.

The most common attacks are browser attacks that target unsuspecting staff members with dangerous links, network abuse attacks, stealthy attacks, evasive technology attacks, and secure sockets layer (SSL) abuse attacks that hide in a company’s encrypted traffic.

These attack types pose a growing threat to companies, accounting for more than 83 million network attacks each quarter, the study showed.

Read more about DDoS attacks

The report said that advanced stealth attacks, which disguise themselves to sneak into company networks, are on the rise.

Despite 387 new threats being detected every minute, according to Intel Security, the study showed that 30% of European organisations review their security only once a year or less frequently.

On average, UK organisations review their security strategy every nine months, which is slightly worse than the overall average of eight months.

Despite this, the study revealed that 75% of UK IT professionals believe their organisation’s security strategy always considers the latest threats.

However, the research showed that 73% admit their organisation’s overall security posture would benefit ‎from a security strategy that takes into consideration systems that proactively work together and inform each other of their findings.

DDoS attacks

Distributed denial-of-service (DDoS) attacks are also identified as a significant threat. DDoS attacks are typically used by hacktivists or competitors to block access to websites.

These attacks are also increasingly used by criminals as a smokescreen for other types of attack or to extort money from organisations by holding them to ransom by threatening DDoS attacks or encrypting all their data using ransomware.

According to the report, network abuse, including DDoS attacks, is the most prevalent form of network attack, accounting for 45% of all network attacks.

However, just 19% of UK IT professionals questioned believe DDoS attacks pose the biggest threat to their company network, and just 17% believe cyber extortion poses any real threat to their company network, with only 2% regarding ransomware or cyber extortion as the biggest threat to their company’s security.

Read more about ransomware

“With new threats being developed every minute of every day, IT teams within organisations need to rethink their approach to network security,” said Ashish Patel, regional director of network security for Intel Security in UK and Ireland.

“Relying on broad brush security strategies that aren't updated in line with the newest threats will leave companies increasingly vulnerable to the growing capabilities of cyber criminals,” he said.

According to Patel, it is crucial for IT professionals take time to gain a real understanding of how the network attack landscape is evolving and which threats their company must prioritise defeating.

“Our research shows there is a real disconnect between the evolving network abuse and IT teams’ comprehension of the threat these methods pose to their organisation,” he said.

With suspect links on the rise, Patel said companies cannot afford to overlook non-technical staff when it comes to security training because these employees are often the most susceptible to online threats.

“The significant growth of network attacks relying on methods such as DDoS, ransomware, SSL abuse attacks and advanced stealth techniques should urge IT departments and security professionals to assess their security strategies in line with these rising threats,” he said.

Patel added that IT professionals should focus on assessing how their existing systems communicate with each other to better secure their network.

Read more on Privacy and data protection