Attacks/Breaches
5/1/2014
05:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

A Crisis of Confidence Among Security Pros

New report shows that a majority of security professionals worldwide doubt they can stop or quell attacks.

There's a sense of unease among security professionals around the globe on how well they can truly protect their organizations from cyberattacks, a new report finds.

Some 57% of security pros say their organizations aren't protected from advanced attacks, and 63% don’t think they can stop confidential information from leaking out of the enterprise, a new report by the Ponemon Institute says. Nearly 70 percent say they believe threats slip by their installed security systems.

Ponemon surveyed 4,881 IT and IT security practitioners in Australia, Brazil, Canada, China, France, Germany, Hong Kong, India, Italy, Mexico, the Netherlands, Singapore, Sweden, the UK, and the US, for the report. Some 44% say they had been hit with one or more "substantial" attack over the past year.

Existing security products don't provide much help, either, in more than half of the organizations, and 59% say they don't have sufficient intelligence about attacks or are unsure about the impact of them. 

The responses in the report may be the result of the realization that attacks are inevitable, as well as a touch of pessimism, according to Jeff Debrosse, director of security research at Websense, which commissioned the report. "The very fact that a large percentage of the respondents -- 69% -- believe that their existing security systems are missing some of the attacks means that the false sense of security is decreasing. The idea of 'no silver bullet' is taking hold, and more organizations are realizing that one or two point solutions just aren’t going to cut it."

Many security pros aren't confident they truly grasp the threats to their organizations, with just 41% confident that they do. Some 37% were sure that confidential or sensitive data had been lost in an attack, and 35% of those organizations didn't know specifically what data had been taken.

"The above-ground economy has historically done a pretty poor job at organizing and sharing intelligence on attackers, victims, and the tactics and techniques. The contrast to the underground economy is significant," Debrosse says. "Attackers reuse known tools and tactics, share intel on their targets/victims, and have organized themselves at different times -- staying fluid to dynamically adjust to their circumstances."

Company executives still are not getting the true cost of a breach: 80% of the respondents say their execs don't see the connection between lost data and potential lost revenue, and nearly 60% say their execs have  "sub-par" comprehension of security threats and issues.

"While there are significant differences among countries for specific questions (such as availability of cyberattack intelligence), the overall analysis indicates that a majority of security professionals do not feel adequately armed to defend their organizations from threats," says Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. "This challenge is further compounded by a perception that company leaders do not believe that data breaches will lead to loss of revenue. Our research has shown this is simply untrue."

Meanwhile, customer data is the most commonly targeted data, in 47% of the cases, followed by intellectual property (35%), and financial records (19%). Some 35% say they don't know what type of data is targeted.

Ponemon's full "Exposing the Cybersecurity Cracks: A Global Perspective" report is available for download here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 11:55:10 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Agree. It would be iluminating to know how the actuaries are calculating risk in order to make a profit!
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/5/2014 | 11:48:37 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Story of my life, a dollar short and a day late.  However, this expansion into the cyber injury arena by AIG demonstrates effectively that there is a market.  I would expect the number of companies offering insurance to grown significantly over the next decade.  

The only issue I see is that generally in the insurance industry the way you can offer reasonable premiums to your clients is to have a good mix of high risk and low risk clientele.  However, who would be your low risk clientele in this arena?  If a company doesn't retain sensitive information then they wouldn't need the insurance.  However, if a company does retain sensitive information then how could they not be high risk?

I suppose it will take someone smarter or craftier than myself to figure this conundrum out.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/5/2014 | 9:59:32 AM
Re: Accepting Reality -- cyber insurance -- an emerging market
Robert, AIG has beat you to the punch. Last month, the company became the first major insurer to expand the emerging cyber insurance market beyond corporate losses arising from data breaches. More info from Financial Times in AIG offers insurance against cyber injury.

 





 

 

Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 1:30:28 PM
Re: Accepting Reality
Unfortunately, I don't think it has made its way to senior management yet.  In my experience there are few in senior management who understand the true value of information security. The line of thinking the majority of C level executives possess in regards to information security falls into two different categories.  The first of these is the belief that an information security department should be able to prevent anything bad from happening.  The second is the "nothing has happened" therefore why should I pay for information security mentality.  Regrettably, most people in senior management do not truly comprehend or appreciate the dynamics of our industry.

To address your second point, I think cyber incident insurance is a great idea.  If I had the capital to start an insurance company, I might just steal your idea! 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
5/2/2014 | 11:15:11 AM
Re: Accepting Reality
Drew, are you sure you shouldn't be working on Wall Street?
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 11:13:52 AM
Re: Accepting Reality
I'm curious if this acceptance of reality has trickled up to senior management, and whether it might make cyber-insurance seem more worthwhile?

If so, I wonder if we'll see a derivatives market emerge for cyber-insurance policies: put together some risk pools, and then set an over/under on a breach.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
5/2/2014 | 10:45:42 AM
Re: Accepting Reality
I agree, this is just the reality in our business.  I work with some of the most talented security professionals in the country and not a single one of us would proclaim that we 'are confident' we know all the threats to our organization.  The truth of the matter is that no matter how much you research or plan something will sneak up and bite you eventually.

The goal is to protect yourself as best you can and be preparred for when an incident arises.
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
5/2/2014 | 10:04:04 AM
Re: Accepting Reality
It is almost impossible to stop every threat that exists on your network but the key is to be mindful of the threats and use forums to stay informed of ways other people defend their information. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/2/2014 | 9:42:25 AM
Re: Accepting Reality
I agree, @Drew Conry-Murray. It's a good sign they can make an honest assessment of their security postures. Now comes the hard part, of course.

(And btw, your avatar always cracks me up). Happy Friday!
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
5/2/2014 | 9:36:30 AM
Accepting Reality
These results sound like industry professionals acknowledging reality. This isn't to say it's time to give up and go home; instead, it's better to understand the grim reality and then find ways to cope instead of pretending everything's fine.
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

CVE-2014-4449
Published: 2014-10-22
iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-4450
Published: 2014-10-22
The QuickType feature in the Keyboards subsystem in Apple iOS before 8.1 collects typing-prediction data from fields with an off autocomplete attribute, which makes it easier for attackers to discover credentials by reading credential values within unintended DOM input elements.

CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.