Focus on Business Priorities Exposing Companies to Avoidable Cyber-Risk

A high percentage of organizations are exposed to avoidable cyber-risk because of a persisting tendency to put business interests ahead of safety, a new study by Tanium shows.

The security vendor surveyed some 500 CIOs and CISOs from companies with more than 1,000 employees about the challenges and trade-offs they face in protecting their organizations against cyberthreats.

Almost all respondents (94%) admitted to making security compromises to accommodate business priorities. Eighty-one percent, for instance, said they had on at least one occasion delayed deploying a critical security update or patch because of concerns over the potential impact to business operations. Fifty-two percent admitted to doing so on more than one occasion.

"Another common area of compromise is network segmentation," says Ryan Kazanciyan, chief technology officer at Tanium. Security practitioners often want micro-segmentation and strict device isolation to contain breach fallout, while endpoint and network teams tend to fall back to overly permissive architectures.

"As a result, the blast radius of many breaches - such as those that entail self-propagating malware - is much larger than it should be," Kazanciyan says.

A relentless pressure to keep the lights on is the most common reason security teams make these compromises: One-third of the respondents in the Tanium survey cited this when asked to describe why they sometimes held back on needed security measures.

In addition, 31% said a focus on implementing new business systems often took precedence over protecting existing ones, and 26% said the presence of legacy systems in the environment restricted their security capabilities. Nearly one in four (23%) of respondents described internal politics as one reason why they are forced to make security compromises.

Uninterrupted operations and time-to-market considerations have almost always taken precedence over security at a high-percentage of organizations. The Tanium survey results suggest little has changed on this front despite data breaches, growing compliance requirements, and increasingly sophisticated threats.

"As leaders, CIOs and CISOs face multifaceted pressures across the business to remain resilient against disruption and cyberthreats," Kazanciyan says. "They must maintain compliance with an evolving set of regulatory standards, track and secure sensitive data across computing devices, [and] manage a dynamic inventory of physical and cloud-based assets."

And they need to do all of this while also fulfilling an increasingly common executive mandate to make technology an enabler for business growth, he notes.

"But balancing these priorities often causes significant challenges and trade-offs for many business and IT leaders," Kazanciyan says. A lack of understanding about the need for resiliency among business leaders and upper management is a major factor. Nearly one in two (47%) survey respondents said they faced challenges on this front, and 40% said business units' tendency to prioritize customer-facing issues over security was a problem.

However, Tanium's survey shows that business priorities are not the only reason why security teams are hampered.

A lack of visibility across laptops, servers, virtual machines, and cloud infrastructure is also hampering the ability of security teams to make confident decisions and from operating efficiently.

Thirty-two percent of the respondents said the siloed manner in which their business units operated provided them with little of the visibility and control needed for effective security. For example, 80% admitted to occasions where a critical patch or security update that they thought had been deployed had, in fact, not been deployed across all impacted systems.

"CIOs and CISOs broadly understand how important these efforts are but run up against two key limitations: reliance on inaccurate data about the state of their systems and an inability to enact critical changes with the confidence that they can quickly identify and recover from unexpected failures," Kazanciyan says.

Many CISOs and CIOs are acutely aware of the dangers of compromising on security. Thirty-five percent expressed concern about data loss, 33% worried about a loss of customer trust, and 25% said they were worried that the security compromises they were making would make it harder for them to comply with regulatory requirements.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.