Attacks/Breaches

4/3/2019
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Focus on Business Priorities Exposing Companies to Avoidable Cyber-Risk

Despite the growing sophistication of threats and increase compliance requirements, a high percentage of organizations are continuing to compromise their security.

A high percentage of organizations are exposed to avoidable cyber-risk because of a persisting tendency to put business interests ahead of safety, a new study by Tanium shows.

The security vendor surveyed some 500 CIOs and CISOs from companies with more than 1,000 employees about the challenges and trade-offs they face in protecting their organizations against cyberthreats.

Almost all respondents (94%) admitted to making security compromises to accommodate business priorities. Eighty-one percent, for instance, said they had on at least one occasion delayed deploying a critical security update or patch because of concerns over the potential impact to business operations. Fifty-two percent admitted to doing so on more than one occasion.

"Another common area of compromise is network segmentation," says Ryan Kazanciyan, chief technology officer at Tanium. Security practitioners often want micro-segmentation and strict device isolation to contain breach fallout, while endpoint and network teams tend to fall back to overly permissive architectures.

"As a result, the blast radius of many breaches - such as those that entail self-propagating malware - is much larger than it should be," Kazanciyan says.

A relentless pressure to keep the lights on is the most common reason security teams make these compromises: One-third of the respondents in the Tanium survey cited this when asked to describe why they sometimes held back on needed security measures.

In addition, 31% said a focus on implementing new business systems often took precedence over protecting existing ones, and 26% said the presence of legacy systems in the environment restricted their security capabilities. Nearly one in four (23%) of respondents described internal politics as one reason why they are forced to make security compromises.

Uninterrupted operations and time-to-market considerations have almost always taken precedence over security at a high-percentage of organizations. The Tanium survey results suggest little has changed on this front despite data breaches, growing compliance requirements, and increasingly sophisticated threats.

"As leaders, CIOs and CISOs face multifaceted pressures across the business to remain resilient against disruption and cyberthreats," Kazanciyan says. "They must maintain compliance with an evolving set of regulatory standards, track and secure sensitive data across computing devices, [and] manage a dynamic inventory of physical and cloud-based assets."

And they need to do all of this while also fulfilling an increasingly common executive mandate to make technology an enabler for business growth, he notes.

"But balancing these priorities often causes significant challenges and trade-offs for many business and IT leaders," Kazanciyan says. A lack of understanding about the need for resiliency among business leaders and upper management is a major factor. Nearly one in two (47%) survey respondents said they faced challenges on this front, and 40% said business units' tendency to prioritize customer-facing issues over security was a problem.

However, Tanium's survey shows that business priorities are not the only reason why security teams are hampered.

A lack of visibility across laptops, servers, virtual machines, and cloud infrastructure is also hampering the ability of security teams to make confident decisions and from operating efficiently.

Thirty-two percent of the respondents said the siloed manner in which their business units operated provided them with little of the visibility and control needed for effective security. For example, 80% admitted to occasions where a critical patch or security update that they thought had been deployed had, in fact, not been deployed across all impacted systems.

"CIOs and CISOs broadly understand how important these efforts are but run up against two key limitations: reliance on inaccurate data about the state of their systems and an inability to enact critical changes with the confidence that they can quickly identify and recover from unexpected failures," Kazanciyan says.

Many CISOs and CIOs are acutely aware of the dangers of compromising on security. Thirty-five percent expressed concern about data loss, 33% worried about a loss of customer trust, and 25% said they were worried that the security compromises they were making would make it harder for them to comply with regulatory requirements.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
4/4/2019 | 10:31:48 AM
Invisible threat too
A very large perception not measured is that you cannot SEE a security threat or breach directly.  Customer complaints by email or letter catch an eye --- cancelled contracts do too.   These are events that anyone from staff to C-Suite can see and touch.  Threats inside the network, though, are silent and cannot be seen by most people save professionally trained staff.  The security people can see it most of the time.   But it is not a broken glass door, wall theft or missing document printed form.  So business management can walk right past it with a song in their heart, confident that those IT guys are keeping servers running, desktop solid and so forth.  As a matter of fact, they are doing it so well that we can outsource them out and save money by hiring young and dumb.  Now these chaps WILL know security, right?????    What management does not see can hurt them.
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11378
PUBLISHED: 2019-04-20
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. It is possible for users to read arbitrary files and (potentially) access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code.
CVE-2019-11372
PUBLISHED: 2019-04-20
An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test in Tag/File__Tags.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11373
PUBLISHED: 2019-04-20
An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer.cpp in MediaInfoLib in MediaArea MediaInfo 18.12 leads to a crash.
CVE-2019-11374
PUBLISHED: 2019-04-20
74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.
CVE-2019-11375
PUBLISHED: 2019-04-20
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI.