Risk

3/30/2011
12:50 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

(Slightly) More Organizations Proactively Managing Security Efforts

Security vendor survey at the RSA Conference 2011 shows more organizations planning and coordinating their security efforts across security and IT operations teams and risk management groups. But don't plan on a party and fireworks celebration just yet - the improvements are minor.

Security vendor survey at the RSA Conference 2011 shows more organizations planning and coordinating their security efforts across security and IT operations teams and risk management groups. But don't plan on a party and fireworks celebration just yet - the improvements are minor.According to security vendor SenSage's recent and not so pithily titled The State of Security Information and Event Management Processes: A Survey of Security Professionals' Attitudes About Security Operations, Measurement and Data Analysis report, small steps in the right direction are being made. For instance, in 2010 about 42 percent of those surveyed at least planned and documented process coordination among IT operations, security operations, and risk managers, and a good portion of those actually measured the amount of process coordination in place. In their 2011 survey, that number jumped to 47 percent.

However, for you glass half-empty folks - that still means 53 percent range from no coordination to "reactive triage across teams." However, a year ago that number was an even worse 58 percent.

Of course, trying to hype the need for its technology, SenSage is hyping the relatively poor state of most enterprises' ability to measure security effectiveness.

However, the data does show an improvement, year over year. And it's a dramatic improvement from a few years ago when even reactive triage among these teams was a pipe dream in many companies. These stakeholders weren't even talking. At least now they are.

And there's more discussion among security managers around metrics and the ability to measure and improve security processes than ever before. It's good to see the security profession start to take these steps and grow up. There's much more work to do, of course, as the results from the survey below show, but at least the industry is heading in the right direction:

• Sixty-five percent of enterprises say that they have no measurement to benchmark the effectiveness of these processes, or that this measurement is inconsistent.

• More than a third (34 percent) of respondents said that they have no proactive efforts in place to improve the five processes, or that their improvement efforts have been inconsistent.

• As a result of this absence of coordination, measurement, and proactivity, most organizations (57 percent) perceive these five core areas of security management to be ineffective or "somewhat effective" at best.

Where is your organization? Are your operations and security teams working together? Is your organization mature enough now to be measuring your progress? We'd be interested in hearing about your experience.

For my security and technology observations throughout the day, you can find me on Twitter @georgevhulme.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
New Locky Ransomware Takes Another Turn
Kelly Sheridan, Associate Editor, Dark Reading,  11/10/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.