Why Cybersecuritys Visibility Gap Matters,

and How Organizations Can Solve It

 INTRODUCTION
What you see: a deluge of security alerts; support-desk calls; malware-infected machines; hints of external data
transfers; the lingering digital detritus of cyber attacks within your network. These are trailing indicators of an attack, and
they all unfold within the traditional network perimeter.

What you dont see: malicious emails opened off your network; social media accounts impersonating your brand
and surveilling your people; mobile apps that siphon sensitive data from workers personal devices on the go. As the way
we work changes, these have become leading indicators of an attackthe stage where it is most effectively detected
and blocked. And they all happen outside of your network, well beyond the sightline of traditional security tools.

This visibility gap has become one of cybersecuritys most acute and fastest-growing problems. Even as organizations
spend upwards of $100 billion per year1 on the latest tools, cyber attackers keep getting through. Data continues to be
stolen. Breaches keep appearing in the news. And the losses continue to mount.

Todays business transcends the bounds of traditional network perimeters and connected endpoints. It transpires over
email. It flows through social networks. It plays out across all types of mobile devices.

As the modern workforce has moved beyond the network, so have cyber attackers. Thats why todays threats require
seeing beyond the networkinto every channel, every device, everywhere your people, data, and brand are.

Unfortunately, most security tools still focus on the parameter and endpoints. This approach may be somewhat useful for
detecting threats already inside your environment. But it does little to stop them from getting there in the first place. And
worse, it illuminates only the last stage of the attack, leaving you blind to most of the attack lifecycle. Without this insight,
you cant prevent attacks or respond effectively.

About three quarters of breached organizations learn that theyve been attacked through an outside party.2 A
whopping 98% didn't discover the breach until a week after the fact.3 And more than half aren't confident they found
the root cause.4

How organizations learn they've been breached

80% Fraud Detection Law Enforcment Third Party Internal

60%

40%

20%

0%

2005 2007 2009 2011 2013 2015

Verizon Data Breach Investigations Report

In other words, when it comes to one of the most catastrophic events that can happen to a company, most never see
it coming. And many dont know what happened even after the fact.

This paper examines the origins of this visibility gap, its consequences, and how to expand your field of view to better
protect your people, data, and brand.
1 Steve Morgan (Forbes). Worldwide Cybersecurity Spending Increasing to $170 Billion by 2020. March 2016.
2 Verizon. Data Breach Investigations Report. April 2016.
3 Ponemon Institute. "The Post Breach Boom." February 2013.
4 Ibid.

BLIND SPOTS: Why Cybersecuritys Visibility Gap Matters, and How Organizations Can Solve It 3
MOST ATTACKS BEGIN OUTSIDE YOUR NETWORK
Even when cyber attacks exploit a technical vulnerability,
they usually involve people. The holiday 2013 data breach at
Targetone of the highest-profile cyber attacks everstarted
with a phishing email sent to an employee at the retail giants
air-conditioning vendor.5
While most attacks still occur via email, social networks and
mobile devices are fast becoming popular threat vectors.6
More than one in every five clicks to a malicious URL takes
place off the corporate network through email, social networks,
or on mobile devices.7
The already-massive volume of malicious messages continues
to rise. In the first quarter of 2016, malicious email message
volume (emails that contain harmful URLs and file attachments)
increased by 66% over the fourth quarter 2015and more than
800% vs. the year-ago quarter.8
At the same time, brands are using social media more than ever
to interact with their audiences. But many of those interactions
are hijacked by attackers using similar-looking accounts to
spread malware, promote fraud, and steal credentials.
On the mobile front, dangerous apps downloaded from
rogue marketplaces affect two in five enterprises.9 Lured in
by free clones of popular games and banned apps, users
who download apps from rogue marketplacesand bypass
multiple security warnings in the processare four times more
likely to download an app that is malicious. These apps steal
personal information, passwords, and data.

LOOKING FOR THREATS IN ALL THE WRONG PLACES

Conventional cyber defenses focus on hardening the
network perimeter, defending the edge of your environment
to keep attackers out. This might have made sense in
an earlier era, when work took place on company-owned
machines, always connected to your network, and inside
the four walls of your office.
Today, theres no edge to defend. People work from
everywhere, through many channels, and on a range of
mobile devices.
Network visibility is important. But a myopic focus on
network-based threats gives you only a partial view of the
complete threat landscape.
Most attacks start with people, well beyond the control
and safety of your network. By the time signs of the attack
appear on the network, the attack is well underway and may
have already succeeded. The best defenses stop attacks
where they start: email, social media, and mobile devices.
Email threats
More than 90% of targeted attacks are launched through
email, exploiting the weakest link in the security chain: people.
Nearly a third of people who receive a malicious email will open
iton or off the network. And about 12% click the malicious
attachment or link.10
Someone clicks the malicious file or link within the first four
minutes of a typical phishing campaign.11 Once that click occurs,
the user is usually infected within seconds. So if you cant see
attacks that arrive through email, youre missing most of them.
Social
Social media accounts are easy to set up and rarely policed.
Its no wonder that 40% of Facebook accounts and 20% of
Twitter accounts related to Fortune 100 brands are fake.12
These accounts are designed to steal customer data, damage
the brand, manipulate markets, and commit fraud.
In early 2016, Dutch attackers stole account credentials
of about 100 Instagram users in Europe who had large
followings. Using those credentials, the attacks impersonated
the account holders and contacted various advertisers with
offers to promote their brand through the Instagram account.
Many companies fell for it, giving the attackers tens of
thousands of euros.13

5 Krebs on Security. Email Attack on Vendor Set Up Breach at Target. February 2014.
6 Proofpoint. Quarterly Threat Summary: Jan-Mar 2016. April 2016.
7 Proofpoint. The Human Factor 2016. February 2016.
8 Proofpoint. Quarterly Threat Summary: Jan-Mar 2016. April 2016.
9 Ibid.
10 Verizon. 2016 Data Breach Investigations Report. April 2016.
11 Ibid.
12 Proofpoint. The State of Social Media Infrastructure. 2014.
13 Proofpoint. Instagram Attack Spotlights Blended Social Media and Email Trend. March 2016.

4 BLIND SPOTS: Why Cybersecuritys Visibility Gap Matters, and How Organizations Can Solve It
Indexed Volume of Social Media Activity Per Hour

Legitimate Activity

Spam Activity

12AM 1 2 3 4 5 6 7 8 9 10 11 12PM 1 2 3 4 5 6 7 8 9 10 11

Hour of Day (UTC)

Mobile accounting for more than 2 billion downloads. Malicious apps

Bring-your-own device (BYOD) policies have become the norm send data to servers in 56 countries outside the U.S.; China is
in many workplaces. And in those that dont have a formal the top overseas destination.14
BYOD policy, people are bringing their mobile devices anyway.
Malicious apps are an attractive vector for attackers. Unlike
Mobile-device-management (MDM) vendors have rushed in email-based campaigns, which rely on spam messages to
to help plug this new security risk. These tools help enforce millions of users, an app placed in a single store can reach
security policies, but on their own, they dont determine which millions of potential users.
mobile apps are safe and which ones pose risk. These mobile
risks can include: Another mobile threat is riskware. These are apps that, while
not always overtly malicious, engage in risky behavior. Riskware
Account takeover is invisible to mobile device management tools, which is why
Leaked data theyre found on so many employee- and company-owned
Hijacked devices mobile devices. These apps exhibit a wide range of dangerous
Privacy violations behavior that leads to leaked sensitive enterprise data, stolen
Adware credentials, or exfiltrated dataoften used to target employees
Risk to your brand in future attacks.

Our analysis of authorized Android app stores discovered

more than 12,000 malicious mobile apps capable of stealing
information, creating backdoors, and other functions

14 Proofpoint. The Human Factor 2016. February 2016.

BLIND SPOTS: Why Cybersecuritys Visibility Gap Matters, and How Organizations Can Solve It 5
Where stolen data was sent in mobile-based attacks in 2016

Z
1.2%
3.8%
6.9%
Russian Federation
19.1%
4.0%
Germany
Republic of Korea
48.8% China
Netherlands

2.1%
United States 4.1%

Japan
Hong Kong

Source: Human Factor 2016

THE COST OF TUNNEL VISION

This lack of visibility increases your risk, makes security incidents
more difficult to resolve, and leads to more costly cleanups.
Greater risk
You cant secure what you cant see. As more attacks originate
off your network, a network-fixated defense will miss an ever-
growing percentage of them. Network-based detection tools
see only the final stages of cyber attacks, when the attacker
already has a foothold in your environment.
By the time the threat is detected on the network, the attack
may have already succeeded.
outside of the network perimeter. Without visibility beyond the
network, tracing them to their source and knowing their full
scope is difficult.
Cleaning up and remediating a cyber attack takes an average
of 31 days at a cost of $20,000 per day.17 The more PCs the
attack has had time to infect, the costlier they become.
Ponemon Institute outlined six factors that contribute to the
costs of a data breach beyond the value of lost data18:
Investigating the root cause of the data breach

Delayed detection Determining the probable victims

Attackers can access compromised systems for months before Organizing the incident response team
their victim detects the attack. Financial firms, which deploy
Building a communications and public-relations strate-
some of the most advanced network tools available, take an
gy about the breach
average of 98 days to discover an attack.15 The retail sector
fairs even worse, at 197 days.16 Preparing notice documents and other required disclo-
sures to victims and regulators
Delayed detection means the attacker has more time to spread
Rolling out call center procedures and specialized training
laterally across your environment, steal more data, and cause
more damage. All of these are more difficult and expensive without the forensics
and insight you get only when you look beyond the network.
Costlier cleanup
Network-only visibility slows the processand in turn raises
the costsof resolving security incidents. Most attacks begin

15 Ponemon Institute. Advanced Threats in Financial ServicesA Study of North America and EMEA. May 2015.
16 Ponemon Institute. Advanced Threats in RetailA Study of North America and EMEA. May 2015.
17 Kelly Jackson Higgins (InformationWeek). "Cost of a Data Breach Jumps By 23%." October 2014.
18 Ponemon Institute. 2015 Cost of Data Breach Study: Global Analysis. May 2015.

6 BLIND SPOTS: Why Cybersecuritys Visibility Gap Matters, and How Organizations Can Solve It
 CONCLUSION AND RECOMMENDATIONS
Aware of todays cyber threats, organizations are investing millions into new technologies to detect, block,
and resolve attacks. Unfortunately, most of these tools are looking in the wrong places.

Organizations must look beyond the network. We recommend a three-pronged approach to bridging the
visibility gap:

1. Identify key blind spots. Determine whether your current defense is in the flow of todays attacks.
That means email, social media, and mobile devices.

2. Create a plan to close the gaps. The specifics of this plan will hinge on the size of your organi-
zation and security team. It may include modeling your return on investment and potential impact
to your security operation.

3. Consider solutions to improve visibility. The best tools will not only detect threats beyond the
network but tie into your incident response tools. Visibility into todays threat vectors enhances your
ability to respond to current threats and makes the next one even easier to stop.

To learn more about the risks you may not be seeing, schedule a free Proofpoint threat assessment. Our
simple, non-invasive process will help you assess your security posture. Youll get a clearer picture of
threats and vulnerabilities in your environment.

Email
Our email risk assessment shows you who is being targeted and how (ransomware, credential
phishing, BEC, and so on).

Mobile
Our mobile defense risk assessment shows you what mobile applications your users have on
their phones and what each of those apps is doing.

Social
Our social risk assessment provides a snapshot of all accounts associated with your brands
corporate, unauthorized, and fraudulent.

Data Discover
A Data Discover risk assessment shows you where sensitive data lives within your environment.

To schedule an assessment, visit https://www.proofpoint.com/us/cybersecurity-assessment.

BLIND SPOTS: Why Cybersecuritys Visibility Gap Matters, and How Organizations Can Solve It 7
ABOUT PROOFPOINT
Proofpoint, Inc. (NASDAQ:PFPT), a next-generation cybersecurity company, enables organizations to protect the way their people work
today from advanced threats and compliance risks. Proofpoint helps cybersecurity professionals protect their users from the advanced
attacks that target them (via email, mobile apps, and social media), protect the critical information people create, and equip their
teams with the right intelligence and tools to respond quickly when things go wrong. Leading organizations of all sizes, including over
50 percent of the Fortune 100, rely on Proofpoint solutions, which are built for todays mobile and social-enabled IT environments and
leverage both the power of the cloud and a big-data-driven analytics platform to combat modern advanced threats.

Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries.
www.proofpoint.com All other trademarks contained herein are property of their respective owners.