IT pros lack support to manage security intelligence
SolarWinds, in conjunction with SANS, today released the results of a security survey of more than 600 IT professionals representing a broad range of industries and organization sizes. The survey was conducted to identify the impact of security threats and the use of security analytics and intelligence to mitigate those threats.
Survey respondents generally agreed that support for managing security today was inadequate. Many are working with a limited budget to manage “information security, compliance and response,” with nearly half of respondents reported spending 20 percent or less of their IT budget on security. A majority also expressed their need for greater security data visibility and context, and said they plan to invest in training to address those issues.
Targeted attacks that are missed by antivirus and other point solutions were a problem for most respondents. Forty-five percent of respondents reported that in the past two years their organization experienced one or more attacks that were difficult to detect. Another 21 percent reported that they lacked enough visibility to even answer the question.
Survey respondents generally agreed that support for managing security today was inadequate. Many are working with a limited budget to manage “information security, compliance and response,” with nearly half of respondents reported spending 20 percent or less of their IT budget on security. A majority also expressed their need for greater security data visibility and context, and said they plan to invest in training to address those issues.
Targeted attacks that are missed by antivirus and other point solutions were a problem for most respondents. Forty-five percent of respondents reported that in the past two years their organization experienced one or more attacks that were difficult to detect. Another 21 percent reported that they lacked enough visibility to even answer the question.
Reported “difficult to detect” attacks took, on average, one full week to detect. The root cause was usually visibility, with specific causes such as:
- Not collecting appropriate operational and security data
- Lack of context to observe normal behavior (and set baselines)
- Lack of system and vulnerability awareness.
IT pros seeking to avoid breaches used data from a variety of sources in their security analytics. The data most frequently used included:
- Log data from networks and servers
- Network monitoring data
- Access data from applications and access control systems.
In the next 12 months, respondents said they also plan to use the following data to improve their security monitoring:
- Security assessment data from endpoint, application and server monitoring tools
- Monitoring and exception data pertaining to internal virtual and cloud environments
- Access data from applications and access control systems.
IT pros plan to invest in the following to get better visibility and response through security analytics and security intelligence:
- SIEM tools
- Training
- Vulnerability management.