Yesterday we announced the findings from our second annual “State of Network Security” survey, which we conducted to identify and analyze current and trending security risks and operational challenges. In our 2013 findings, manual, time-consuming processes and change management issues have a major impact on both security and operations. We’ve also seen rising adoption and maturity around the use of Next-Generation Firewalls (NGFWs) and increasing concern over insider threats. Here are some of the highlights:
Process is the Problem – A majority of respondents (60 percent) cited poor processes and lack of visibility into security policies as the greatest challenge of managing network security devices. Organizations that have poor processes defined and/or enforced commonly face a multitude of security and business risks.
Out-of-Process Increases Out-of-Service – More than three-quarters of respondents (76.6 percent) suffered a network or application outage due to an out-of-process change – an increase of 21.1 percent from last year’s findings. What this tells us is that IT organizations are struggling to keep up with the pace of the business and in cases where changes are made “out-of-process”, oftentimes the result is quite harmful to the business.
Application-related Rule Changes Gone Awry – A whopping 80.6 percent of survey respondents said they suffered an outage, security breach or decreased network performance due to an application-related rule change. Enterprise applications fuel the business, but these applications and the underlying network security policy – while tightly intertwined – are often managed in silos which can result in outcomes that are bad for security and bad for business!
Firewall the Next-Generation is Now – The number of respondents that have adopted Next-Generation Firewalls (NGFWs) is now at 57 percent, up from 41.2 percent in our 2012 survey. But, in exchange for increased security, 56 percent of respondents said they had increased work to manage the firewall process, with 46 percent citing they must make more changes.
The Lurking Threat from Within – One of the more controversial findings is that survey respondents noted that the most significant risks come from insiders – 40.8 percent of identified accidental insider risks, i.e. data leakage, as the greatest risk while 24.6 percent noted malicious insiders. BYOD also plays a significant role in this discussion since two-thirds of respondents said that allowing employees to connect personnel devices to the network increases the risk of a security breach. These findings are in stark contrast to other research, like the Verizon Data Breach report, which notes that external threats represent the greatest risk to organizations. It’s worth noting that The State of Network Security Survey is not analyzing breaches, but asking security and operations professionals to share their concerns. So maybe this is a perception versus reality? This topic certainly deserves more discussion and debate!
Security in the Cloud a Cloudy Forecast? – Another finding that may raise some eyebrows is that a majority of respondents (60 percent) said they have less than a quarter of their security controls in the cloud – and the larger the organization, the less likely they will have more security controls in the cloud.
The goal of our survey is to understand the concerns of pracitioners and use this data to identify areas of improvement. I’m sure as with any survey findings, this will be dissected and reviewed and we look forward to continuing the discussion and debate. If you’d like to read the entire report, you can download it from http://www.algosec.com/en/resources/network_security_2013.
Receive notifications of new posts by email.