Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/3/2012
05:40 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

2012 Strategic Security Survey: Pick The Right Battles

Whether it's cloud computing, mobile devices, or insecure software, some threats are more prevalent than others. Our latest survey delves into where security pros are putting their resources.

InformationWeek Green - Mar. 7, 2011 InformationWeek Green
Download the entire May 7, 2012 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Pick Your  Battles

What's the biggest challenge facing security teams? It's not preventing breaches, meeting compliance demands, or even vying for executive attention. It's managing complexity, our InformationWeek 2012 Strategic Security Survey finds. Now, we've been running this study for 15 years, and security has never, ever been simple. But over the past decade the threats have piled up; we have too many fancy technologies to deploy and long-winded policies to enforce--with no guarantee that any of them will reduce risk.

So let's break it down. Prioritize the threats most likely to affect your company. If you try to block every conceivable attack, you'll stretch your people and resources so thin that something is bound to break. Stop worrying about what you can't control or predict and focus like a laser on where you can make an impact. That includes tried-and-true basics like strong access control. It includes taking a hard look at potential cloud providers' security claims, and writing Web apps and business software with an eye toward reducing vulnerabilities. It means being prepared for when a salesperson leaves an iPad in a taxi or has her phone snatched out of her hand.

We'll provide guidance on these areas in this article and go into more depth in our full 2012 Strategic Security Survey report. We'll also delve into what 946 business technology and IT security professionals from companies with 100 or more employees told us in our latest in-depth look at the security landscape.

What's In That Cloud, Anyway?

Our 2012 State of Cloud Computing Survey shows adoption of public cloud on a consistent upward pace; just 27% of 511 respondents from companies with 50 or more employees aren't in the market for these services. Unfortunately, in 2011, only 18% of our Strategic Security respondents actually assessed the security of cloud providers. This year, that number jumped to 29%. However, another 14% rely on the self-audit reports vendors provide. An example is the SSAE 16, a widely used set of auditing standards that providers say attest to controls they have in place.

We don't recommend blindly accepting these reports. One reason is that SSAE 16 attestations contain different sets of scope and system descriptions, so one provider's SSAE 16 may be dramatically different from another's. A better bet? The Cloud Security Alliance explicitly lays out a set of security best practices for cloud providers across a variety of domains, including encryption, data center management, cloud architecture, and application security. The CSA's guidelines are much more prescriptive, and the group offers the Security Trust and Assurance Registry, a free, publicly accessible registry that documents the security controls inherent in various cloud offerings. All providers can submit self-assessment reports that document compliance with CSA-published best practices.

When it comes to cloud computing risks, the most prominent concern among our survey respondents is unauthorized access to or leak of customer information. That's unchanged from 2011. Other top concerns include worries about security defects in cloud technology and the loss of proprietary data.

Pick The Right Battles

Our full 2012 Strategic Security report is available free with registration.

This report includes 44 pages of action-oriented analysis, packed with 38 charts. What you'll find:
  • Security guidance on cloud, mobile and more
  • How to get value from collecting security metrics
Get This And All Our Reports


To read the rest of the article,
Download the May 7, 2012 issue of InformationWeek

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Doug Barbin
50%
50%
Doug Barbin,
User Rank: Apprentice
5/8/2012 | 4:12:45 AM
re: 2012 Strategic Security Survey: Pick The Right Battles
Based on the comments in the narrative regarding SSAE 16 and CSA STAR, I was hoping that the survey itself would provide more depth on the types of assurance tools that security professionals use and/or rely on it. If there is such data not included in the findings report, I believe the readers would find it relevant. SSAE 16 (or SOC 1) has specific use cases. STAR, as shown via Microsoft's submissions has a nice tie-in to ISO 27001 certification but could also be attached to an attestation report. What about PCI and FedRAMP? https://www.BrightLine.com contains additional information for SSAE 16, SOC 2, PCI DSS, ISO 27001 certification, and more.
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-3154
PUBLISHED: 2020-01-27
CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
CVE-2019-17190
PUBLISHED: 2020-01-27
A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the...
CVE-2014-8161
PUBLISHED: 2020-01-27
PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values by triggering constraint violation and then reading the error message.
CVE-2014-9481
PUBLISHED: 2020-01-27
The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping special page HTML.
CVE-2015-0241
PUBLISHED: 2020-01-27
The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a (1) large number of digits when processing a numeric ...