Top trends in security testing and vulnerability management
Many businesses fail to conduct frequent security testing despite believing that it’s critically important to securing their systems and data. One in five of businesses surveyed admitted they don’t do any security testing, despite the fact that 95 percent of survey respondents reported encountering one of the dozen common security issues associated with security vulnerabilities.
The findings are based on an Osterman Research survey of 126 security professionals who have knowledge about or responsibility for security testing within their organizations.
Key findings
Most organizations are not proactive about security testing – Fewer than one in four organizations consider themselves to be “very proactive” in the context of security testing, while nearly one-half are “somewhat proactive.” However, nearly one-third of organizations consider themselves “somewhat” to “very” reactive about security testing, or that their security testing posture is “non-existent.”
Many organizations do not conduct security testing – One in five organizations has not performed security testing of any kind during the past six months. Among those that do conduct security testing, 66 percent do so only monthly or less frequently, and most do not perform regular security testing after every infrastructure change. Most organizations conduct security testing using a combination of in-house resources and third-party testing services, although two in five organizations manage security testing only in-house.
Most organizations find security testing a valuable best practice – Despite the fact that many organizations do not conduct security testing, two-thirds believe that security testing is a valuable best practice.
Security testing and reviews are infrequent and, in some cases, organizations are leaving it up to fate – Both security testing and reviews of these tests are not commonplace: only 5 percent perform detailed reviews of security testing to assess vulnerabilities on a daily basis and only 24 percent do so weekly or multiple times during the week. Meanwhile, 25 percent of the organizations surveyed perform these reviews only quarterly or annually, and 20 percent do so only when they perceive the need, creating a situation where businesses are simply guessing when to test their systems.
Security skills shortage and testing challenges abound – Among the leading security testing challenges discovered in the survey, the most commonly cited are insufficient staffing, insufficient time with which to perform the security tests, and insufficient skills to support regular testing.
More than half of organizations are turning to third parties for help with security testing – To address these issues, a large proportion of those surveyed are open to the idea of using third parties, like managed security services providers, to perform security testing on their behalf. Thirty-five percent of those surveyed already do partner with a third-party for security testing, and another 21 percent plan to do so during the next year. Only 9 percent of those surveyed don’t plan to use third-party security testing services.
No one is immune to cyber attacks – 95 percent of survey respondents reported encountering one of the dozen common security issues associated with security vulnerabilities that were listed in the survey.
“Emerging trends like shadow IT, mobility and Internet of Things make regular security testing more important than ever,” said Kevin Overcash, Director of SpiderLabs at Trustwave. “This includes both automated security scanning, which will help uncover potential vulnerabilities and weak configurations, and in-depth penetration testing, which is designed to exploit vulnerabilities just like criminals would in the real world.”
“This report should be a major wake-up call for businesses and government agencies that a new approach and strategy for security vulnerability testing is required to better fortify databases, networks and applications against data theft and breaches,” said Michael Osterman of Osterman Research. “Organizations need to look at security testing more comprehensively and perform it more frequently. Increasingly, security-savvy organizations are turning to managed security services providers for help in this area.”