Live
- Hockey World Cups: Germany men, Spain women clinch their spots as FIH starts One Year to Go countdown
- USDC is Gaining Popularity, and RICH Miner Has Launched a Stable Coin Daily Income Solution.
- Independence Day celebrated as one of greatest festivals: Himachal Pradesh Governor
- War 2 Box Office Day 1: Hrithik Roshan and Jr NTR’s Spy Thriller Opens Strong
- HYDRAA a great system to protect Hyderabad: CM Revanth Reddy
- Elon Musk Says Google Has Edge in AI Race — But Not for Long
- Venkatesh–Trivikram collaboration film gets and official launch
- ‘Oka Parvathi Iddaru Devadasulu’ promises a youth entertainer
- ‘Border 2’ poster unveiled; Sunny Deol-led war epic locks release date
- Karan Johar says Bollywood faces a ‘director crisis’, urges focus on core strengths
Cybercriminals wiped out logs in 82% of attacks with missing telemetry: Report
Representational Image
Cybercriminals disabled or wiped out logs in 82 per cent of attacks with missing telemetry between January 1, 2022, to June 30, 2023, a new report said on Thursday.
New Delhi: Cybercriminals disabled or wiped out logs in 82 per cent of attacks with missing telemetry between January 1, 2022, to June 30, 2023, a new report said on Thursday.
Telemetry automatically gathers, transmits and measures data from remote sources, using sensors and other devices to collect data.
As explained by the cybersecurity firm Sophos, gaps in telemetry decrease much-needed visibility into an organisation’s networks and systems, especially since attacker dwell time (the time from initial access to detection) continues to decline, shortening the time defenders have to effectively respond to an incident.
In the report, the researchers classified ransomware attacks with a dwell time of less than or equal to five days as “fast attacks,” which accounted for 38 per cent of the cases studied.
“Slow” ransomware attacks are those with a dwell time greater than five days, which accounted for 62 per cent of the cases.
"Missing telemetry only adds time to remediations that most organisations can’t afford. This is why complete and accurate logging is essential, but we’re seeing that, all too frequently, organisations don’t have the data they need," said John Shier, field CTO, Sophos.
According to the researchers, when examining these “fast” and “slow” ransomware attacks at a granular level, there was not much variation in the tools, techniques, and living-off-the-land binaries (LOLBins) that attackers deployed, suggesting defenders don’t need to reinvent their defensive strategies as dwell time shrinks.
"Cybercriminals only innovate when they must, and only to the extent that it gets them to their target. Attackers aren’t going to change what’s working, even if they’re moving faster from access to detection," said Shier.
The report is based on 232 Sophos Incident Response (IR) cases across 25 sectors. Targeted organisations were located in 34 different countries across six continents.
About 83 per cent of cases came from organisations with fewer than 1,000 employees.
