Attacks/Breaches
2/20/2014
06:00 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

IT Pros Okay With Government's Role In Cybersecurity

Most U.S. IT pros see feds' involvement in security a positive, new Dell survey shows

So much for the Snowden effect: nearly 80 percent of U.S. IT leaders say the federal government plays a key and positive role in protecting enterprises from internal and external cyberthreats, a new survey commissioned by Dell Software found.

"How people think about government is particularly interesting, [as] 78 percent [in the U.S.] say it's helping," says Bill Evans, senior director of product marketing for Dell. The survey of 1,440 IT decision-makers worldwide in organizations with more than 500 users was conducted between October and November of last year.

"I don't know if people are believing there is a business value in compliance and government mandates or if frameworks are of value. This is one of the areas I'd like to delve deeper into," Evans says. But it seems to bode well for the new NIST Cyber Security Framework, he says.

Close to 90 percent of all respondents worldwide say government should help determine security defense strategies of organizations.

Meanwhile, three-fourths of organizations say they have been hit by a security breach within the past 12 months, while more than 80 percent say their current security processes let them identify a breach, but actual detection takes an average of seven hours.

But interestingly, just 18 percent of IT pros say the detection and prediction of unknown threats is a top concern. "What we took from that is that security pros are focused on things they know have to be focused on," Evans says. "They're trying to do a good job, spending more money, but becoming less secure ... They don't have time to focus on unknown threats."

Even so, they could solve some of those "unknown" threats with existing technologies, he says, such as identity management, encryption, and next-generation firewalls, Evan says.

Around 64 percent of all IT pros say their organizations must reorganize or restructure their IT processes to keep pace with new security threats; some 85 percent of U.S. IT pros believe this.

Nearly 70 percent are spending more money on user education and training for security in the past year, and about half say user education is a priority. More than half of the organizations worldwide have increased funding for monitoring services, and 72 percent of U.S. organizations have done so.

Mobile devices are dogging IT pros. While 93 percent allow personal devices to be used on the job, 57 percent say mobile security is a top concern in the next five years, and nearly one-fourth say the misuse or vulnerabilities of those devices are the root cause of breaches.

The full report by Dell is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0485
Published: 2014-09-02
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5136
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.