Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

9/5/2017
11:40 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Endpoint Security Overload

CISOs and their teams are over-investing in endpoint security tools, driving inefficiency and a need to consolidate data.

An excess of endpoint security tools in organizations is driving "information security debt," according to a new study.

The "Voice of the Enterprise" report by 451 Research and Digital Guardian on the use and consolidation of endpoint security tools found that the more endpoint security systems an enterprise has, the greater the cost of managing them. Security teams are struggling with inefficiency because they're moving from dashboard to dashboard all day.

Eric Ogren, senior analyst with 451 Research's information security team, says having more endpoint security tools doesn't necessarily provide better endpoint protection.

Overall spending on endpoint systems rose from 26.3% in 2015 to 29.4% in 2016, according to the study. The focus on risk was aligned with addressing an overall need for more skilled security professionals.

"We hear so much about the labor shortage; how hard it is for security teams to hire and retain people," says Ogren. "The problem's not so much a people problem, but a technology one. Every time you tie an endpoint product to a workstation, it's going to be noisy."

Researchers found two-thirds of larger businesses juggle up to five endpoint security tools; about one in ten respondents handle as many as ten. The surplus is leading to greater operational overhead and additional steps to learn about data generated about users, applications, and OS activity. As a result, infosec teams are overwhelmed and ultimately fail to protect against data loss.

Endpoint security has traditionally been very threat- and exploit-oriented, and businesses invest in point products when new risks appear. These tools stay put for a long time because each was bought for a particular need. As a result, enterprises have accumulated several solutions for data loss prevention, data encryption, access controls, intrusion detection, and firewalls.

Every endpoint tool produces a lot of events and a lot of data, Ogren explains, and "most of it is just junk." Security pros spend much of their time digging into, and clearing, endless alerts. They want to get trained on security and handling the business but don’t have time.

A data-focused approach

Researchers discovered a broad shift towards the consolidation of endpoint tools. Capabilities like disk encryption and host firewall/IDS, previously offered in individual products, are being incorporated into product suites or built into operating systems. The goal isn't only to remove silos between tools, but to create a more immediate view of threats to business data.

By consolidating endpoint systems, businesses can consistently collect accurate data and gain a broader view of their security posture without switching consoles. Leveraging analytics across large datasets can help monitor and prevent threats throughout an organization.

"It tackles information debt straightaway," says Ogren of consolidation. "Products have been a bit more comprehensive about their approach to security and what they import. What does get reported tends to be a lot more meaningful and a lot richer, with more analysis behind it."

The cloud is driving this trend, he notes, as businesses shift away from hardware-based products and toward cloud services. Hardware security tools made up 20% of security budgets one year ago compared with 17.9% today, and a predicted 17.1% in 2018, researchers found.

Bumps in the road

The shift to consolidation will have its obstacles, Ogren predicts. It will be difficult for security leaders to "de-commit" to a security problem by saying the business no longer needs a tool.

"Some CISOs put their credibility and integrity on the line, and it takes maturity to say 'the world has moved on, this is how we need to approach security now,'" he explains.

Many will also face the challenge of moving from a threat-centric approach to endpoint security, and towards a data-centric approach. Security teams will have to look at how their resources are being used before they address threats.

451 Research's Voice of the Enterprise study found the top three security pain points for the 12 months ending in June 2018 include user behavior (30.4%), accurate and timely monitoring of security events (21.8%), and staffing information security teams (20.7%).

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
LouiseMiller
50%
50%
LouiseMiller,
User Rank: Apprentice
10/10/2017 | 9:07:29 AM
Interesting
Very interesting post, as for me) 
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-2916
PUBLISHED: 2019-11-15
qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.
CVE-2019-12757
PUBLISHED: 2019-11-15
Symantec Endpoint Protection (SEP), prior to 14.2 RU2 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to 12.1 RU6 MP10d (12.1.7510.7002), may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt t...
CVE-2019-12758
PUBLISHED: 2019-11-15
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code without a resident proper digital signature.
CVE-2019-12759
PUBLISHED: 2019-11-15
Symantec Endpoint Protection Manager (SEPM) and Symantec Mail Security for MS Exchange (SMSMSE), prior to versions 14.2 RU2 and 7.5.x respectively, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software applicat...
CVE-2019-18372
PUBLISHED: 2019-11-15
Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.