Cisco Annual Security Report Exposes Widening Gulf between Perception and Reality of Cyber Threats
The Cisco 2015 Annual Security Report released today, which examines both threat intelligence and cybersecurity trends, reveals that organizations must adopt an ‘all hands on deck’ approach to defend against cyber attacks. Attackers have become more proficient at taking advantage of gaps in security to evade detection and conceal malicious activity. Defenders, namely, security teams, must be constantly improving their approach to protect their organization from these increasingly sophisticated cyber attack campaigns. These issues are further complicated by the geopolitical motivations of the attackers, conflicting cross-border data localizations and sovereignty requirements.
Cisco’s “Security Manifesto” The report findings conclude that its time for corporate boards to take a role in setting security priorities and expectations. Cisco’s “Security Manifesto”, a formal set of security principals as a foundation to achieving security, can help corporate boards, security teams and the users in the organization, to better understand and respond to the cybersecurity challenges of today’s world. It can serve as a baseline for organizations as they strive to become more dynamic in their approach to security and more adaptive and innovative than adversaries. The principals are: Security must support the business. Security must work with existing architecture – and be usable. Security must be transparent and informative. Security must enable visibility and appropriate action. Security must be viewed as a “people problem.”
Defenders: Results from Cisco’s Security Benchmark Study, which surveyed Chief Information Security Officers (CISO’s) and Security Operations executives at 1700 companies globally reveals a widening gap in defender intent and actions. Specifically, the study indicates that 75 percent of CISOs see their security tools as very or extremely effective. However, less than 50 percent of respondents use standard tools such as patching and configuration to help prevent security breaches and ensure that they are running the latest versions. Heartbleed was landmark vulnerability last year, yet 56% of all OpenSSL versions are over 4.5 years old. That is a strong indicator that security teams are not patching.
While many defenders believe their security processes are optimized—and their security tools are effective—in truth, their security readiness likely needs improvement.