{"id":55952,"date":"2021-10-29T13:53:58","date_gmt":"2021-10-29T17:53:58","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=55952"},"modified":"2024-12-20T14:29:21","modified_gmt":"2024-12-20T19:29:21","slug":"hackers-know-breach-detection-gap","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/hackers-know-breach-detection-gap","title":{"rendered":"Hackers Know What You Did Last Summer: Exploring the Breach Detection Gap"},"content":{"rendered":"\n
It\u2019s Cybersecurity Awareness Month! In honor of the theme \u2014 Do Your Part. #BeCyberSmart \u2014 we\u2019re doing our part by educating organizations and IT teams on protecting themselves. Throughout October, the JumpCloud blog will focus on top cybersecurity issues, from IT admin best practices to CISO responsibilities. Tune back into the blog this month for new cybersecurity content or <\/em>check out our archive of existing security articles<\/em><\/a> for cybersecurity insights written specifically for the IT professional. <\/em><\/p>\n\n\n\n After much of the business world went remote in 2020, data breaches rose significantly \u2014 not just in number, but in cost and impact as well. In fact, IBM found that the average data breach now costs $4.24 million<\/a>. <\/p>\n\n\n\n The same study found that data breaches take an average of 212 to detect and another 75 days to contain. So if there are any hackers currently on your network, chances are, they know what you did last summer. And even though they probably won\u2019t mail you ominous letters or carry a hook for a hand \u00e0 la the classic \u201890s slasher flick, they can still wreak havoc on your business. <\/p>\n\n\n\n That\u2019s because, in the 212 days they sat on your network undetected, they had been watching, waiting, and learning. This time window, called the breach detection gap, indicates a problem in the way companies monitor and detect threats on their network.<\/p>\n\n\n\n Why don\u2019t companies notice breaches sooner? How can they protect themselves against breaches and detect them when they occur? In this blog, we\u2019ll explore causes of the breach detection gap, what can happen when a hacker infiltrates your network without your knowledge, and how to better detect and protect against breaches.<\/p>\n\n\n\n The breach detection gap is the result of both stealth on the hacker\u2019s part and failed detection on the company\u2019s part. Sometimes, hackers choose to wait quietly once they\u2019ve compromised a network to avoid detection. Other times, they may be working in the background and the network failed to detect the threat. Let\u2019s explore each scenario.<\/p>\n\n\n\n The rise of remote work and the novelty of distributed infrastructure generated infrastructure complexity that hackers have learned to use to their advantage. Because the shift to remote work was rushed for many at the onset of the pandemic, many IT teams are still ironing out the kinks. Hackers are aware of some common remote infrastructure issues and have learned to exploit them, both for initial infiltration and to fly under the radar once inside the network.<\/p>\n\n\n\n In particular, some of the complicating factors that make it difficult to detect breaches include:<\/p>\n\n\n\n Whether a hacker infiltrates your network, either waiting or jumping into action, your systems need to be able to immediately detect the threat and alert you to it, stop it if possible, and mitigate the threat if not. The following approaches and solutions help IT teams set up a system capable of doing so.<\/p>\n\n\n\n Zero Trust, considered a must in today\u2019s modern business environment, is the modern-day response to outdated perimeter-based security<\/a>: once the physical perimeter dissipated, so did the efficacy of traditional security. In its place, Zero Trust security always prescribes verification before authorization, a principle summed up by the Zero Trust mantra: trust nothing; verify everything.<\/em>\u00a0<\/p>\n\n\n\n With Zero Trust, users, devices, and networks must be verified with approaches such as multi-factor authentication (MFA)<\/a> rather than a simple username\/password before they\u2019re granted access to their resources. This is true of all login attempts, not just initial network access, which helps prevent lateral movement in the event of a breach. Identity-based policies bolster this effort, ensuring users are only assigned access to the resources they absolutely need and automating role-based authorization.<\/p>\n\n\n\n Monitoring and reporting tools should approach the infrastructure holistically rather than application by application. They should be able to deliver insights on device, user, and network status and activity, drilling down to granular insights and reliably flagging suspected IoCs. <\/p>\n\n\n\n Insights are best delivered as part of a unified directory<\/a>, where the directory that manages all of the organization\u2019s users, devices, networks, and resources can report on their activity holistically, adding context and aiding in analysis. For example, JumpCloud\u00ae<\/sup>, a cloud directory platform<\/a>, offers Directory Insights<\/a> that report on every identity, device, and resource in your organization. It gathers them into contextualized and manipulable reports that allow for quick analyses as well as detailed drill-downs.<\/p>\n\n\n\n As organizations bring on more applications and technology to accommodate remote work, IT needs to keep all the moving pieces unified. While traditional directories tend to stick to on-premise resources and fail to unify a largely cloud-based infrastructure, cloud directories are emerging to fulfill this need. <\/p>\n\n\n\n JumpCloud, for example, is a Zero Trust platform that can unify everything from users to all of their applications, controlling access, identity, security, and insights in a single platform. See how it works in our free demo<\/a>. <\/p>\n\n\n\n Even with the right detection tools, your organization is at risk of compromise if it\u2019s still operating on a perimeter-based security model. The first step to achieving better security is to transition to a Zero Trust model \u2014 especially for companies working with remote or hybrid-remote teams in distributed environments. To learn more about how to get started with Zero Trust, download the free whitepaper, Zero Trust Security: A Transformative Way to Secure Your Hybrid Workspace.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":" Most data breaches take months to detect, unintentionally giving hackers visibility into what your organization has been up to. Learn how to detect and stop threats in this Cybersecurity Awareness Month blog.<\/p>\n","protected":false},"author":144,"featured_media":55953,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"categories":[2337],"tags":[2373,2374],"collection":[2775],"platform":[],"funnel_stage":[3016],"coauthors":[2532],"acf":[],"yoast_head":"\nBreach Detection Gap Driving Factors <\/strong><\/h2>\n\n\n\n
\n
\n
Why Do Companies Fail to Detect Breaches?<\/strong><\/h2>\n\n\n\n
\n
\n
\n
\n
How to Improve Detection<\/strong><\/h2>\n\n\n\n
Zero Trust Security<\/h3>\n\n\n\n
Monitoring and Reporting Tools<\/h3>\n\n\n\n
Unified Directory<\/h3>\n\n\n\n
Next Step: Establish Zero Trust<\/strong><\/h2>\n\n\n\n