Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/3/2012
05:40 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

2012 Strategic Security Survey: Pick The Right Battles

Whether it's cloud computing, mobile devices, or insecure software, some threats are more prevalent than others. Our latest survey delves into where security pros are putting their resources.

InformationWeek Green - Mar. 7, 2011 InformationWeek Green
Download the entire May 7, 2012 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Pick Your  Battles

What's the biggest challenge facing security teams? It's not preventing breaches, meeting compliance demands, or even vying for executive attention. It's managing complexity, our InformationWeek 2012 Strategic Security Survey finds. Now, we've been running this study for 15 years, and security has never, ever been simple. But over the past decade the threats have piled up; we have too many fancy technologies to deploy and long-winded policies to enforce--with no guarantee that any of them will reduce risk.

So let's break it down. Prioritize the threats most likely to affect your company. If you try to block every conceivable attack, you'll stretch your people and resources so thin that something is bound to break. Stop worrying about what you can't control or predict and focus like a laser on where you can make an impact. That includes tried-and-true basics like strong access control. It includes taking a hard look at potential cloud providers' security claims, and writing Web apps and business software with an eye toward reducing vulnerabilities. It means being prepared for when a salesperson leaves an iPad in a taxi or has her phone snatched out of her hand.

We'll provide guidance on these areas in this article and go into more depth in our full 2012 Strategic Security Survey report. We'll also delve into what 946 business technology and IT security professionals from companies with 100 or more employees told us in our latest in-depth look at the security landscape.

What's In That Cloud, Anyway?

Our 2012 State of Cloud Computing Survey shows adoption of public cloud on a consistent upward pace; just 27% of 511 respondents from companies with 50 or more employees aren't in the market for these services. Unfortunately, in 2011, only 18% of our Strategic Security respondents actually assessed the security of cloud providers. This year, that number jumped to 29%. However, another 14% rely on the self-audit reports vendors provide. An example is the SSAE 16, a widely used set of auditing standards that providers say attest to controls they have in place.

We don't recommend blindly accepting these reports. One reason is that SSAE 16 attestations contain different sets of scope and system descriptions, so one provider's SSAE 16 may be dramatically different from another's. A better bet? The Cloud Security Alliance explicitly lays out a set of security best practices for cloud providers across a variety of domains, including encryption, data center management, cloud architecture, and application security. The CSA's guidelines are much more prescriptive, and the group offers the Security Trust and Assurance Registry, a free, publicly accessible registry that documents the security controls inherent in various cloud offerings. All providers can submit self-assessment reports that document compliance with CSA-published best practices.

When it comes to cloud computing risks, the most prominent concern among our survey respondents is unauthorized access to or leak of customer information. That's unchanged from 2011. Other top concerns include worries about security defects in cloud technology and the loss of proprietary data.

Pick The Right Battles

Our full 2012 Strategic Security report is available free with registration.

This report includes 44 pages of action-oriented analysis, packed with 38 charts. What you'll find:
  • Security guidance on cloud, mobile and more
  • How to get value from collecting security metrics
Get This And All Our Reports


To read the rest of the article,
Download the May 7, 2012 issue of InformationWeek

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Doug Barbin
50%
50%
Doug Barbin,
User Rank: Apprentice
5/8/2012 | 4:12:45 AM
re: 2012 Strategic Security Survey: Pick The Right Battles
Based on the comments in the narrative regarding SSAE 16 and CSA STAR, I was hoping that the survey itself would provide more depth on the types of assurance tools that security professionals use and/or rely on it. If there is such data not included in the findings report, I believe the readers would find it relevant. SSAE 16 (or SOC 1) has specific use cases. STAR, as shown via Microsoft's submissions has a nice tie-in to ISO 27001 certification but could also be attached to an attestation report. What about PCI and FedRAMP? https://www.BrightLine.com contains additional information for SSAE 16, SOC 2, PCI DSS, ISO 27001 certification, and more.
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32094
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
CVE-2021-32095
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
CVE-2021-32096
PUBLISHED: 2021-05-07
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
CVE-2021-32098
PUBLISHED: 2021-05-07
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
CVE-2021-32099
PUBLISHED: 2021-05-07
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.