Security News > 2021 > March > Microsoft: Firmware Attacks Outpacing Security Investments
According to a new Security Signals report released Tuesday by Microsoft, a whopping 80 percent of businesses reported "At least one firmware attack" in the past two years but only 30 percent allocated any budget spend on firmware protection.
Businesses aren't paying close enough attention to securing this critical layer, says David Weston, Microsoft partner director of OS security.
Microsoft commissioned a study of 1,000 enterprise security decision makers from around the world and the results confirmed that the bulk of current security spending goes to applying patches, vulnerability scanning, and advanced threat protection products that traditionally miss signs of infections below the operating system.
"Security teams are too focused on outdated"protect and detect" models of security and are not spending enough time on strategic work - only 39% of security teams' time is spent on prevention and they don't see that changing in the next two years.
"Seventy-one percent said their staff spends too much time on work that should be automated, and that number creeps up to 82% among the teams who said they don't have enough time for strategic work. Overall, security teams are spending 41% of their time on firmware patches that could be automated," the study found.
Microsoft is pushing its own secured-core PC concept, encouraging businesses to to invest in chip-level security and new automation and analytics capabilities.
News URL
Related news
- Patch Tuesday: Microsoft Fixes 57 Security Flaws – Including Active Zero-Days (source)
- Hidden Threats: How Microsoft 365 Backups Store Risks for Future Attacks (source)
- AI agents swarm Microsoft Security Copilot (source)
- AI-Powered SaaS Security: Keeping Pace with an Expanding Attack Surface (source)
- After Detecting 30B Phishing Attempts, Microsoft Adds Even More AI to Its Security Copilot (source)
- Android Malware Exploits a Microsoft-Related Security Blind Spot to Avoid Detection (source)
- Week in review: Chrome sandbox escape 0-day fixed, Microsoft adds new AI agents to Security Copilot (source)
- Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware (source)
- April 2025 Patch Tuesday forecast: More AI security introduced by Microsoft (source)
- New TCESB Malware Found in Active Attacks Exploiting ESET Security Scanner (source)