Facebook Twitter LinkedIn RSS
    Trending
    • NITRA-ALTON CNII & Sustainability Conference Rescheduled for August 7, 2025
    • Nigerians to earn 18% annual income with Luno’s Crypto Staking
    • USSD wahala reloaded: Are telcos quietly dipping into your airtime? By Elvis Eromosele
    • Gartner recognizes Sophos as 2025 leader for endpoint protection platforms
    • TIM AKANO FOUNDATION Awards Scholarships to 100 OAU Students and 22 Undergraduates from Oluponna and Surrounding Areas
    • Sustaining Innovation in Africa’s Tech Startup Ecosystem – Bidemi Oke, CEO of FlashChange
    • Data is the new oil: Africa Data Centres Executive on digital transformation
    • Nigeria’s economy sees boost in Q1 2025, driven by surging ICT sector
    Facebook Twitter LinkedIn
    ITPulse.com.ngITPulse.com.ng
    • News
    • Interviews
    • Blogs
    • Analysis
    • Opinion
    • Videos
    • Press Releases
    • Pictures
    • Advertise
    ITPulse.com.ngITPulse.com.ng
    Home»News»Cybersecurity: New report finds telemetry logs missing in 42% of attack cases
    News 4 Mins Read

    Cybersecurity: New report finds telemetry logs missing in 42% of attack cases

    mmBy ITPulseNovember 20, 2023
    Facebook Twitter WhatsApp Pinterest LinkedIn Reddit Tumblr Email
    Share
    Facebook Twitter LinkedIn Pinterest Email

    A new report by Sophos, a global leader in innovating and delivering cybersecurity as a service has found that, telemetry logs were missing in nearly 42% of the attack cases studied. Also in the report Active Adversary Report for Security Practitioners, it was found that In 82% of these cases, cybercriminals disabled or wiped out the telemetry to hide their tracks.

    The report covers Incident Response (IR) cases that Sophos analyzed from January 2022 through the first half of 2023.

    Gaps in telemetry decrease much-needed visibility into organizations’ networks and systems, especially since attacker dwell time (the time from initial access to detection) continues to decline, shortening the time defenders have to effectively respond to an incident.

    “Time is critical when responding to an active threat; the time between spotting the initial access event and full threat mitigation should be as short as possible. The farther along in the attack chain, an attacker makes it, the bigger the headache for responders. Missing telemetry only adds time to remediations that most organizations can’t afford. This is why complete and accurate logging is essential, but we’re seeing that, all too frequently, organizations don’t have the data they need,” said John Shier, field CTO, Sophos.

    In the report, Sophos classifies ransomware attacks with a dwell time of less than or equal to five days as “fast attacks,” which accounted for 38% of the cases studied. “Slow” ransomware attacks are those with a dwell time greater than five days, which accounted for 62% of the cases.

    When examining these “fast” and “slow” ransomware attacks at a granular level, there was not much variation in the tools, techniques, and living-off-the-land binaries (LOLBins) that attackers deployed, suggesting defenders don’t need to reinvent their defensive strategies as dwell time shrinks. However, defenders do need to be aware that fast attacks and the lack of telemetry can hinder fast response times, leading to more destruction.

    “Cybercriminals only innovate when they must, and only to the extent that it gets them to their target. Attackers aren’t going to change what’s working, even if they’re moving faster from access to detection. This is good news for organizations because they don’t have to radically change their defensive strategy as attackers speed up their timelines. The same defenses that detect fast attacks will apply to all attacks, regardless of speed. This includes complete telemetry, robust protections across everything, and ubiquitous monitoring,” said Shier. “The key is increasing friction whenever possible—if you make the attackers’ job harder, then you can add valuable time to respond, stretching out each stage of an attack.

    “For example, in the case of a ransomware attack, if you have more friction, then you can delay the time until exfiltration; exfiltration often occurs just before detection and is often the costliest part of the attack. We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen. Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”

    The Sophos Active Adversary Report for Security Practitioners is based on 232 Sophos Incident Response(IR) cases across 25 sectors from Jan. 1, 2022, to June 30, 2023. Targeted organizations were located in 34 different countries across six continents. Eighty-three percent of cases came from organizations with fewer than 1,000 employees.

    The Sophos Active Adversary Report for Security Practitioners provides actionable intelligence on how security practitioners should best shape their defensive strategy.

     

    Cybersecurity telemetry logs
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email
    mm
    ITPulse
    • Website
    • Facebook
    • Twitter
    • LinkedIn

    ITPulse is a wholly information technology communication (ICT) news website, with a special focus on the African continent. The website provides up-to-date biz-tech news, analysis and comprehensive and thorough insight into the continent's ICT terrain

    Related Posts

    Nigerians to earn 18% annual income with Luno’s Crypto Staking

    July 23, 2025

    Nigeria’s economy sees boost in Q1 2025, driven by surging ICT sector

    July 22, 2025

    Verve revolutionizes African payments with contactless tech

    July 22, 2025

    Leave A Reply Cancel Reply

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Latest Posts

    NITRA-ALTON CNII & Sustainability Conference Rescheduled for August 7, 2025

    July 24, 2025

    Nigerians to earn 18% annual income with Luno’s Crypto Staking

    July 23, 2025

    USSD wahala reloaded: Are telcos quietly dipping into your airtime? By Elvis Eromosele

    July 23, 2025
    About
    About

    Itpulse.com.ng is a wholly information technology communication (ICT) news website, with special focus on the African continent. The website provides up-to-date biz-tech news, analysis and a comprehensive and thorough insight info the continent's ICT terrain.

    Contact us: editorial@itpulse.com.ng

    Facebook Twitter LinkedIn RSS
    Latest Posts

    NITRA-ALTON CNII & Sustainability Conference Rescheduled for August 7, 2025

    July 24, 2025

    Nigerians to earn 18% annual income with Luno’s Crypto Staking

    July 23, 2025

    USSD wahala reloaded: Are telcos quietly dipping into your airtime? By Elvis Eromosele

    July 23, 2025
    Popular Posts

    Data is the new oil: Africa Data Centres Executive on digital transformation

    July 22, 2025

    Nigeria’s economy sees boost in Q1 2025, driven by surging ICT sector

    July 22, 2025

    Dr. Omoniyi Ibietan: A PR powerhouse redefining strategic communication in Africa

    July 21, 2025
    © 2017 - 2025 Itpulse. Designed by Max Excellence.
    • Terms & Conditions
    • Privacy Policy
    • Advertise
    • Contact Us

    Type above and press Enter to search. Press Esc to cancel.