- Tools & Templates
- Security Jobs
- Data Protection
- Identity & Access
- Business Continuity
- Physical Security
- Security Leadership
Survey says: Your security measuring stick stinks
In a study conducted by SIEM vendor Sensage, participants lament the difficulty of measuring the strength of their security procedures.
Before I delve into this, let's get one thing straight: This study is skewed to fit the message of the vendor issuing it. Most vendors do this sort of thing, and it's not terrible as long as the reader goes in seeing the findings for what they are. In this case, the vendor is Sensage, so you know you're going to see something that preaches the importance of buying the kind of SIEM product they sell.
I occasionally run these because, biases aside, all of these studies, when bundled together, say something interesting about the big picture.
Now that I got that out of the way, let's proceed.
Sensage announced results of its third annual industry survey, called “The Buried Truth: State of Security Information and Event Management Processes.” The study finds a "downward trend" in IT’s ability to consistently coordinate, measure and improve security data management processes, including log management, compliance reporting, real-time monitoring, forensic investigation and incident response -- areas the vendor says are critical to sustaining effective security intelligence.
From the report:
In 2011 and 2012 Sensage asked if respondents needed better data access and analysis:
• In 2011, 57% said “Yes” which clearly indicated a prevalent challenge in this area.
• In 2012, awareness of this challenge appears to have grown significantly, with 79% noting that they need better data access and analysis. Inconsistent Measurement When studying responses stating that professionals had “inconsistent” and “consistent” measurements and comparing them year over year, Sensage discovered that, while slightly more than 50% of the respondents felt they were inconsistently measuring in 2010 and 2011, 61% shared that challenge in 2012.
• This corresponded with a drop in consistent measurement from 31% in both 2010 and 2011 to only 21% in 2012.
• When evaluating reports of “light or no measurement” compared to “heavy measurement,” the numbers were close year over year, but the trend is going in the wrong direction:
• More respondents are taking a light measurement approach - 75% in 2012 compared to 69% in 2010 and 73% in 2011.
• Accordingly, fewer are taking a heavy measurement approach, 25% in 2012, compared to 30% in 2010. Inconsistent Coordination While responses in 2010 and 2011 reflected a close split between those who consider their processes coordinated and those that don’t, that was not the case in 2012, where 66% of respondents felt that they were resorting to reactive triage or had no coordination at all. Inconsistent Process Improvement 2010 and 2012 shared a similar percentage of teams who had no proactive process improvement. Inside the numbers, the data yielded troubling findings:
• The bad news: A massive drop -- from 18% in 2010 to 5% in 2012 -- of those who felt they had a consistent and adequately staffed process improvement program. • More bad news: When comparing respondents who maintain consistent process improvement, there was a significant drop, from 65% in 2011 to 40% in 2012.
• Worse news: 96% of 2012 respondents had no process, inconsistent process or consistent process that was understaffed. Limited Security Effectiveness In 2012, Sensage asked a new survey question to gauge how effectively security practitioners felt they were dealing with security risks. Responses were less than ideal:
• The majority (78%) feel they are under less than ideal circumstances or improving, but still face a lot of heavy-lifting.
• Only 22% of respondents said they were “very effective.”
Sensage initiated the survey in 2010, and every year since has collected over 350 responses to a set of questions about log management, compliance reporting, real-time monitoring, forensic investigation and incident response processes. "The objectives of the survey are to understand how well these processes are working, understand the interdependencies between these processes, and identify barriers likely obstructing process effectiveness," Sensage said.
There you have it.
Thanks to cloud computing, your business data is everywhere and being accessed by everyone. Making the wrong decision to protect your data can result in high costs, increased risk and executive exposure. View this live webinar on cloud security and the evolving data center, and learn why a data-centric approach to security is the best bet for today's virtual environment.
- Fighting Fraud Videos: IBM Intelligent Investigation Manager
- IBM Intelligent Investigation Manager: Online Product Demo
- Webinar: IBM IIM for Fraud, Abuse and Waste in Government
- Redefine Business Portability
- Prevent Mobile Devices from Loading Dangerous Code
- Expanding Your Security Perimeter: Common Sense for Navigating Today's Threat Landscape