Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/3/2019
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Focus on Business Priorities Exposing Companies to Avoidable Cyber-Risk

Despite the growing sophistication of threats and increase compliance requirements, a high percentage of organizations are continuing to compromise their security.

A high percentage of organizations are exposed to avoidable cyber-risk because of a persisting tendency to put business interests ahead of safety, a new study by Tanium shows.

The security vendor surveyed some 500 CIOs and CISOs from companies with more than 1,000 employees about the challenges and trade-offs they face in protecting their organizations against cyberthreats.

Almost all respondents (94%) admitted to making security compromises to accommodate business priorities. Eighty-one percent, for instance, said they had on at least one occasion delayed deploying a critical security update or patch because of concerns over the potential impact to business operations. Fifty-two percent admitted to doing so on more than one occasion.

"Another common area of compromise is network segmentation," says Ryan Kazanciyan, chief technology officer at Tanium. Security practitioners often want micro-segmentation and strict device isolation to contain breach fallout, while endpoint and network teams tend to fall back to overly permissive architectures.

"As a result, the blast radius of many breaches - such as those that entail self-propagating malware - is much larger than it should be," Kazanciyan says.

A relentless pressure to keep the lights on is the most common reason security teams make these compromises: One-third of the respondents in the Tanium survey cited this when asked to describe why they sometimes held back on needed security measures.

In addition, 31% said a focus on implementing new business systems often took precedence over protecting existing ones, and 26% said the presence of legacy systems in the environment restricted their security capabilities. Nearly one in four (23%) of respondents described internal politics as one reason why they are forced to make security compromises.

Uninterrupted operations and time-to-market considerations have almost always taken precedence over security at a high-percentage of organizations. The Tanium survey results suggest little has changed on this front despite data breaches, growing compliance requirements, and increasingly sophisticated threats.

"As leaders, CIOs and CISOs face multifaceted pressures across the business to remain resilient against disruption and cyberthreats," Kazanciyan says. "They must maintain compliance with an evolving set of regulatory standards, track and secure sensitive data across computing devices, [and] manage a dynamic inventory of physical and cloud-based assets."

And they need to do all of this while also fulfilling an increasingly common executive mandate to make technology an enabler for business growth, he notes.

"But balancing these priorities often causes significant challenges and trade-offs for many business and IT leaders," Kazanciyan says. A lack of understanding about the need for resiliency among business leaders and upper management is a major factor. Nearly one in two (47%) survey respondents said they faced challenges on this front, and 40% said business units' tendency to prioritize customer-facing issues over security was a problem.

However, Tanium's survey shows that business priorities are not the only reason why security teams are hampered.

A lack of visibility across laptops, servers, virtual machines, and cloud infrastructure is also hampering the ability of security teams to make confident decisions and from operating efficiently.

Thirty-two percent of the respondents said the siloed manner in which their business units operated provided them with little of the visibility and control needed for effective security. For example, 80% admitted to occasions where a critical patch or security update that they thought had been deployed had, in fact, not been deployed across all impacted systems.

"CIOs and CISOs broadly understand how important these efforts are but run up against two key limitations: reliance on inaccurate data about the state of their systems and an inability to enact critical changes with the confidence that they can quickly identify and recover from unexpected failures," Kazanciyan says.

Many CISOs and CIOs are acutely aware of the dangers of compromising on security. Thirty-five percent expressed concern about data loss, 33% worried about a loss of customer trust, and 25% said they were worried that the security compromises they were making would make it harder for them to comply with regulatory requirements.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
4/4/2019 | 10:31:48 AM
Invisible threat too
A very large perception not measured is that you cannot SEE a security threat or breach directly.  Customer complaints by email or letter catch an eye --- cancelled contracts do too.   These are events that anyone from staff to C-Suite can see and touch.  Threats inside the network, though, are silent and cannot be seen by most people save professionally trained staff.  The security people can see it most of the time.   But it is not a broken glass door, wall theft or missing document printed form.  So business management can walk right past it with a song in their heart, confident that those IT guys are keeping servers running, desktop solid and so forth.  As a matter of fact, they are doing it so well that we can outsource them out and save money by hiring young and dumb.  Now these chaps WILL know security, right?????    What management does not see can hurt them.
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18238
PUBLISHED: 2020-02-26
Moxa ioLogik 2542-HSPA Series Controllers and IOs, and IOxpress Configuration Utility ioLogik 2500 series firmware, Version 3.0 or lower IOxpress configuration utility, Version 2.3.0 or lower. Sensitive information is stored in configuration files without encryption, which may allow an attacker to a...
CVE-2019-17274
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVE-2019-17275
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2020-3169
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
CVE-2020-3170
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...