Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


02:24 PM
Dark Reading
Dark Reading
Products and Releases

Sensage Study Reveals Lack Of Consistency And Process Improvement In Security Management

Study finds a downward trend in IT’s ability to consistently coordinate, measure, and improve security data management processes

REDWOOD SHORES, CA – August 28, 2012 - Sensage, Inc., the leading provider of advanced Security Information and Event Management (SIEM) and founder of Open Security Intelligence, today announced results of its third annual industry survey, entitled “The Buried Truth: State of Security Information and Event Management Processes.” The study finds a downward trend in IT’s ability to consistently coordinate, measure and improve security data management processes, including log management, compliance reporting, real-time monitoring, forensic investigation and incident response—areas that are critical to sustaining effective Security Intelligence.

While resourcing was cited as a major issue this year, as compared to 2011 results, limited access and poor data fidelity were the top barriers preventing organizations from achieving a more sustainable, consistent security management program. The Sensage report, which analyzes results over a three year period, indicates that the massive (and mostly manual) effort associated with collecting and interpreting security data has created a severe downturn in both the mood of security teams, as well as perception of their effectiveness by stakeholders.

“While many referred to 2011 as ‘The Year of the Breach,’ we see 2012 shaping up to be ‘The Year of Inspection,’” said Joe Gottlieb, CEO of Sensage. “Given the responses highlighting the need for better data access, and revealing inconsistent measurement and process improvements, this year’s respondents appear to be much more honest, realistic and self-aware. This is a significant change compared to previous years, as professionals are becoming more vocal about their dissatisfaction with traditional security practices’ inability to provide the intelligence necessary to counter evolving threats and address organizations’ changing requirements.”

Lack of ‘Good’ Data Access and Analysis

The Sensage survey further highlights the demands placed on resource-constrained security teams, identifying a close relationship between the fidelity of security data and work required to analyze and act on information. Many practitioners want more actionable information faster and there is an overall lack of trust in the data they collect. In 2011 and 2012 Sensage asked if respondents needed better data access and analysis:

· In 2011, 57% said “Yes” which clearly indicated a prevalent challenge in this area.

· In 2012, awareness of this challenge appears to have grown significantly, with 79% noting that they need better data access and analysis.

Inconsistent Measurement

When studying responses stating that professionals had “inconsistent” and “consistent” measurements and comparing them year over year, Sensage discovered that, while slightly more than 50% of the respondents felt they were inconsistently measuring in 2010 and 2011, 61% shared that challenge in 2012.

· This corresponded with a drop in consistent measurement from 31% in both 2010 and 2011 to only 21% in 2012.

· When evaluating reports of “light or no measurement” compared to “heavy measurement,” the numbers were close year over year, but the trend is going in the wrong direction:

· More respondents are taking a light measurement approach - 75% in 2012 compared to 69% in 2010 and 73% in 2011.

· Accordingly, fewer are taking a heavy measurement approach, 25% in 2012, compared to 30% in 2010.

Inconsistent Coordination

While responses in 2010 and 2011 reflected a close split between those who consider their processes coordinated and those that don’t, that was not the case in 2012, where 66% of respondents felt that they were resorting to reactive triage or had no coordination at all.

Inconsistent Process Improvement

2010 and 2012 shared a similar percentage of teams who had no proactive process improvement. Inside the numbers, the data yielded troubling findings:

· The bad news: A massive drop – from 18% in 2010 to 5% in 2012 – of those who felt they had a consistent and adequately staffed process improvement program.

· More bad news: When comparing respondents who maintain consistent process improvement, there was a significant drop, from 65% in 2011 to 40% in 2012.

· Worse news: 96% of 2012 respondents had no process, inconsistent process or consistent process that was understaffed.

Limited Security Effectiveness

In 2012, Sensage asked a new survey question to gauge how effectively security practitioners felt they were dealing with security risks. Responses were less than ideal:

· The majority (78%) feel they are under less than ideal circumstances or improving, but still face a lot of heavy-lifting.

· Only 22% of respondents said they were “very effective.”

Sensage initiated this annual survey in 2010, and every year since has collected over 350 responses to a set of questions about log management, compliance reporting, real-time monitoring, forensic investigation and incident response processes. The objectives of the survey are to understand how well these processes are working, understand the interdependencies between these processes, and identify barriers likely obstructing process effectiveness.

To download the complete study, please visit: www.sensage.com/buriedtruth

About Sensage

Sensage®, Inc. helps organizations collect, store, analyze and interpret complex information to identify new threats, improve cyber-security defenses, and achieve industry and regulatory compliance. Sensage serves our customers’ most advanced Security Information and Event Management (SIEM), log management, Call Detail Record (CDR) retention and retrieval and Continuous Controls Monitoring (CCM) use cases. Hundreds of customers worldwide leverage patented Security Intelligence solutions from Sensage to effectively identify, understand and counteract insider threats, advanced persistent threats, cyber threats, fraud and compliance violations.

Combining powerful data warehousing with scalable, clustered multiprocessing and robust analytics, Sensage solutions handle all event data types, scale to petabytes, minimize storage costs and perform sophisticated data analysis. Sensage has achieved Federal Common Criteria and FIPS 140-2 Certification. Sensage partners include Cerner, Cisco, EMC, McAfee and SAP. For more information, visit www.sensage.com, follow us on Twitter: @Sensage, and watch for us on www.youtube.com/Sensagetv.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...