Ignorance Is Not Bliss in the Cyber-Security Arena

Getting a handle on today’s IT and cyber-security environment is nothing short of daunting. Yet, according to a new report from cyber-security firm Cyphort and Ponemon Institute, The State of Malware Detection and Prevention, many organizations aren’t addressing basic issues.

The survey of 600 IT and IT security practitioners in the U.S. reveals that an alarming number of CEOs are completely in the dark about cyber-attacks against their company. Despite the fact that more than 60 percent of companies have been attacked at least once in the past 12 months, a whopping 34 percent of these organizations reported that their CEOs and C-level executives are never updated on cyber-attacks against their organization.

And it goes downhill from there. The study also found that 21 percent of respondents took anywhere from 1 to 2 years or more to detect an attack and 27 percent took anywhere from 1 to 6 months to contain the breach. If there’s any good news, it’s that 30 percent of the organizations surveyed discovered an attack anywhere from 1 to 8 hours after it occurred, and 28 percent were able to contain the breach in 1 to 8 hours.

One cause for concern, the study found, is that security professionals devote an incredible amount of time chasing down false positives. More than two-thirds of respondents said that their security operations team wind up mired in these red herrings. Meanwhile, 32 percent indicated that they spend a significant amount of time prioritizing alerts that need to be investigated.

Another problem is that just over three-quarters of the companies lack visibility of threat activity across the network. In addition, 63 percent are unable to prioritize threats, while 55 percent lack necessary in-house expertise.

Finally, 13 percent of the companies expect their 2016 security budget to decrease. The study found that the average 2016 cyber-security budget is approximately $16 million—with 34 percent of the funds allocated to incident response efforts. Fifty percent say their budget will stay the same and 37 percent expect their budget to increase in 2016.

Clearly, changes are in order. Noted Larry Ponemon, chairman and founder of Ponemon Institute: “Despite catastrophic data breaches such as Target and Sony, cyber-threats are not getting appropriate attention from senior leadership they deserve.” He believes there needs to be a greater emphasis on reducing wasted time and resources, and path to better protection leads next generation network-based sandboxing and network behavior anomaly analysis and detection.