Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/21/2015
04:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Security Budgets Going Up, Thanks To Mega-Breaches

Sixty percent of organizations have increased their security spending by one-third -- but many security managers still don't think that's enough, Ponemon study finds.

Mega-breaches like those at Target and Sony are good for one thing: they help security departments get greater buy-in and bigger budgets from the powers that be. In the wake of the Target breach, 61 percent of organizations increased their security budgets by an average of 34 percent in 2014, according to a study released today, conducted by the Ponemon Institute on behalf of Identity Finder, LLC.

Nevertheless, only 67 percent of respondents said that their organizations gave them sufficient budget to defend against data breaches, even after the Target incident -- which, respondents say upped their upper management's concern about breaches from a 5.7 to a 7.8 on a scale of 1 to 10.

That said, most respondents agreed that they did have adequate tools and personnel to minimize (72%), quickly detect (69%), prevent (65%), and determine the root cause of (55%) data breaches.

Where is the extra money going? The report does not make it clear how much is being invested in new personnel. As for technology spending, the lion's share is going to endpoint security, intrusion detection systems, and security incident and event management (SIEM) systems.

In other words, it's mostly being used on tools that will help detect attacks -- which is important, since 46 percent of survey respondents said they discovered breaches "by accident" and 33 percent said it took them over a year to do so.

Organizations also reported that they'd made operational changes to enhance breach security. Half said they'd begun new security training and awareness activities, and 56 percent established incident response teams.

"Businesses are clearly spending money to prevent cyberattacks, but data breaches still occur. There must be a balance between blocking threats and reducing the footprint of vulnerable, sensitive data," said Todd Feinman, CEO of Identity Finder. "JP Morgan Chase spent over $250 million on cyber security last year, but still suffered from a significant data breach.  The recent Sony cyberattack where millions of instances of Social Security numbers were found within hundreds of files is an unfortunate example of the damage that can occur when an attack gets through and organizations don't properly store and classify sensitive information and don't remove outdated or redundant data completely."

Budgets will probably get another bump this year, now that company executives have Sony, Home Depot, and JP Morgan Chase haunting their dreams. 

To download "2014: Year of the Mega Breach," click here.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
1/22/2015 | 11:31:24 AM
Re: Training: The elephant in the room
Case in point could be Target, the breach that keeps on giving. Incident Response certainly failed them; malware was detected early and not acted upon. I wonder how much training their security team had undergone, and if any security exercises were performed. In an organization as large as that, one would think that those exercises are part of their routine.

"Through our investigation, we learned that after these criminals entered our network, a small amount of their activity was logged and surfaced to our team. That activity was evaluated and acted upon." "Based on their interpretation and evaluation of that activity, the team determined that it did not warrant immediate follow up." Those were the words of a Target spokesperson after the breach. I understand that there are literally hundreds of alerts received by their security team daily, but perhaps with better knowledge and training, certain types of alerts could be elevated and acted upon accordingly.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/22/2015 | 11:17:13 AM
Training: The elephant in the room
It's notworthy that the report is unclear on how much is being invested in training and new personnel. The best technology in the world won't help if the security team doesn't have the expertise to use it effectively.  
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
1/22/2015 | 11:02:21 AM
Re: How does one know what the appropriate level of investment should be?
Those are tough questions to answer, and I doubt you will get definitive ones. If you ask the companies that have been breached, they will likely tell you that they did not have the right level of investment in IT security despite having spent many millions of dollars on it, and that they did not have the right success metrics to evaluate the effectiveness of their IT security. The reality is that the level of investment is really a matter of risk assessment and management. You can easily spend more than the value of that which you wish to protect, so the issue becomes a management decision. Metrics too can be a tricky venture. Periodic security assessments are certainly a must. These should include penetration tests, vulnerability assessments, awareness training tests,  and social engineering tests, the results of which must be tabulated and examined over a course of time for effectiveness. In all cases, the results must trend increasingly to the positive. Additionally, I cannot overemphasize the use of an external party to perform these tests in addition to similar ones performed by internal resources. You must get an objective point of view in order to properly assess your security posture.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/22/2015 | 10:55:38 AM
Re: How does one know what the appropriate level of investment should be?
That's a fantastic question that does not have a definitive answer. Each solution is unique to each enterprise. You want to spend the right amount of capital towards a cyber security program but you also want to ensure that you are not erecting a $1 million fence around a $1 asset. A security program needs to have the right balance of active personnel and tools that are preventative and reactive. This is also dependent on what data types a company houses and who they do business with. My point here is that there is a variety of factors that will go into each implementation. This decision needs to be made by the powers that be but security needs to be one of the seats at the table to rationalize future endeavors. As you can see from the article, even throughing massive amounts of money at the issue doesn't make you 100% secure.
Rickkam
50%
50%
Rickkam,
User Rank: Apprentice
1/21/2015 | 7:20:46 PM
How does one know what the appropriate level of investment should be?
It is good to hear that the average security budget is increasing.  My question relates to how one knows what the right level of investment is?  And also what is the right success metric for security?  
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28973
PUBLISHED: 2021-04-21
The ABUS Secvest wireless alarm system FUAA50000 (v3.01.17) fails to properly authenticate some requests to its built-in HTTPS interface. Someone can use this vulnerability to obtain sensitive information from the system, such as usernames and passwords. This information can then be used to reconfig...
CVE-2021-29456
PUBLISHED: 2021-04-21
Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on (SSO) for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any...
CVE-2021-31523
PUBLISHED: 2021-04-21
The Debian xscreensaver 5.42+dfsg1-1 package for XScreenSaver has cap_net_raw enabled for the /usr/libexec/xscreensaver/sonar file, which allows local users to gain privileges because this is arguably incompatible with the design of the Mesa 3D Graphics library dependency.
CVE-2020-23907
PUBLISHED: 2021-04-21
An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.
CVE-2020-23912
PUBLISHED: 2021-04-21
An issue was discovered in Bento4 through v1.6.0-637. A NULL pointer dereference exists in the function AP4_StszAtom::GetSampleSize() located in Ap4StszAtom.cpp. It allows an attacker to cause Denial of Service.