New research identifies poor incident response and unpatched vulnerabilities

Grim state of cyber security exposed as new report shows fewer than a quarter of firms (23 per cent) are capable of responding effectively to a cyber incident.

In addition to this, the 2016 Global Threat Intelligence Report (GTIR) from NTT Group subsidiary, Solutionary, found nearly 21 per cent of vulnerabilities detected in global client networks were more than three years old.

Some detected vulnerabilities originated as far back as 1999, making them more than 16 years old.

There was a marked drop in DoS/DDoS attacks last year, with incidents falling 39 per cent from levels observed in 2014.

Spear phishing accounted for around 17 per cent of incident response activities supported in 2015, mostly targeting executives and finance personnel with the intent of tricking them into paying fraudulent invoices.

There was an 18 per cent rise in malware detected for every industry other than education.

Finance showed the highest volume of attacks overall, though retail experienced the most attacks per client, with 2.7 times that of finance.

This was followed by the hospitality, leisure and entertainment sector, then insurance, government and manufacturing.

All of the top 10 vulnerabilities targeted by exploit kits during 2015 were related to Adobe Flash.

In 2013, the top 10 vulnerabilities targeted by exploit kits included one Flash and eight Java vulnerabilities.

Java vulnerabilities have dropped steadily since 2013, however the number of Flash vulnerabilities jumped by almost 312 per cent over 2014 levels.

For the latest report, NTT Group pulled information from 24 security operations centers, seven R&D centers, 3.5 trillion logs, 6.2 billion attacks and nearly 8,000 security clients across six continents.

"An effective security program understands the current threat environmentin order to detect what attackers are doing now," the report reads.

"If we truly want to move our security programs forward and manage our limited resources more effectively, we need a comprehensive solution to apply across our entire infrastructure.