Attacks/Breaches
2/20/2014
06:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

IT Pros Okay With Government's Role In Cybersecurity

Most U.S. IT pros see feds' involvement in security a positive, new Dell survey shows

So much for the Snowden effect: nearly 80 percent of U.S. IT leaders say the federal government plays a key and positive role in protecting enterprises from internal and external cyberthreats, a new survey commissioned by Dell Software found.

"How people think about government is particularly interesting, [as] 78 percent [in the U.S.] say it's helping," says Bill Evans, senior director of product marketing for Dell. The survey of 1,440 IT decision-makers worldwide in organizations with more than 500 users was conducted between October and November of last year.

"I don't know if people are believing there is a business value in compliance and government mandates or if frameworks are of value. This is one of the areas I'd like to delve deeper into," Evans says. But it seems to bode well for the new NIST Cyber Security Framework, he says.

Close to 90 percent of all respondents worldwide say government should help determine security defense strategies of organizations.

Meanwhile, three-fourths of organizations say they have been hit by a security breach within the past 12 months, while more than 80 percent say their current security processes let them identify a breach, but actual detection takes an average of seven hours.

But interestingly, just 18 percent of IT pros say the detection and prediction of unknown threats is a top concern. "What we took from that is that security pros are focused on things they know have to be focused on," Evans says. "They're trying to do a good job, spending more money, but becoming less secure ... They don't have time to focus on unknown threats."

Even so, they could solve some of those "unknown" threats with existing technologies, he says, such as identity management, encryption, and next-generation firewalls, Evan says.

Around 64 percent of all IT pros say their organizations must reorganize or restructure their IT processes to keep pace with new security threats; some 85 percent of U.S. IT pros believe this.

Nearly 70 percent are spending more money on user education and training for security in the past year, and about half say user education is a priority. More than half of the organizations worldwide have increased funding for monitoring services, and 72 percent of U.S. organizations have done so.

Mobile devices are dogging IT pros. While 93 percent allow personal devices to be used on the job, 57 percent say mobile security is a top concern in the next five years, and nearly one-fourth say the misuse or vulnerabilities of those devices are the root cause of breaches.

The full report by Dell is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.