2014-03-24
The lack of incident detection and investigation puts companies and their CISOs’ jobs at significant risk, according to the Ponemon Institute.
In a recent survey sponsored by AccessData and which covered 1,083 CISOs, “startling” findings show that when a CEO and Board of Directors asks a security team for a briefing immediately following an incident, 65% of respondents believe that the briefing would be purposefully modified, filtered or watered down.
Also, 78% of those polled believe that most CISOs would make a “best effort guess” based on limited information, and that they would take action prematurely and report that the problem had been resolved without this actually being the case.
The institute reported that this alarming disconnect results from several critical shortcomings in the current point solution approach tocybersecurity and incident response (IR).
First is a lack of timely compromise detection, with 86% of respondents saying detection of a cyber-attack takes too long.
Second is the inability of point solutions to prioritize alerts as they come in, with 85% saying they suffer from a lack of prioritization of incidents.
Third is a lack of integration between point solutions, with 74% saying poor or no integration between security products negatively affects response capabilities.
And finally, an overwhelming number of alerts paralyzing IR efforts, as 61% say too many alerts from too many point solutions also hinders investigations.
“When a cyber attack happens, immediate reaction is needed in the minutes that follow, not hours or days,” said Larry Ponemon, chairman and founder of the Ponemon Institute. “It’s readily clear from the survey that IR processes need to incorporate powerful, intuitive technology that helps teams act quickly, effectively and with key evidence so their companies’ and clients’ time, resources and money are not lost in the immediate aftermath of the event.”
While 66% of respondents believe determining the root cause of prior incidents enables them to strengthen defenses, 38% of respondents say determining the root cause of a compromise could take a year while an alarming 41% believe they would never be able to identify the root-cause of security events with certainty.
Further, integrated threat intelligence – a hugely promising approach to arming CISOs with the latest indicators of compromise (IOC) information and ability to confirm threats – appears to be largely unusable by current security products, with a full 59% of respondents saying they are not able to efficiently and effectively use threat intelligence with their existing security products.
The survey also found that current security products make it difficult to import multiple threat intelligence feeds or quickly investigate mobile devices as 40% say none of their security products support imported threat intelligence from other sources while 86% rate the investigation of mobile devices as difficult.
In addition, 54% say they are not able to or unsure of how to locate sensitive data such as trade secrets and personally identifiable information (PII) on mobile devices.
No comments:
Post a Comment