05.03.2016
SolarWinds, a leading provider of powerful and affordable IT management software, today released the findings of a new survey that highlights significant improvements in IT security preparedness and effectiveness, including steps the most successful IT departments have taken to improve their security posture, but also demonstrates that the threat and consequences of security breaches remain.
“The most surprising finding of the survey is just how many organizations are less vulnerable today than they were a year ago, and, on a related note, how many have implemented security technologies and better security training,” said Mav Turner, director, business strategy, SolarWinds. “While this is a sign the industry is trending in the right direction, it’s important for IT professionals to never get too confident in their organizations’ security posture, which could potentially result in overestimating one’s defenses. After all, the findings also illustrate how high the stakes are—while less than one-third of organizations experienced a security breach in 2015, of those, almost 72 percent store potentially sensitive customer data.”
Fielded between December 2015 and March 2016 in conjunction with Penton Research, the survey yielded responses from 221 IT practitioners, managers, directors and executives in North America from small, midsize and enterprise companies.
“Given the heightened international media attention on IT security breaches, it was a pleasant surprise to see that 55 percent of respondents did not experience any security breaches in 2015, and only 24 percent believe a security breach is likely in 2016,” said Dr. Kristin Letourneau, director of research at Penton. “The survey data seems to reflect a shifting focus from fear of cyberattack, to the implementation, maintenance and refinement of established and effective security systems.”
Key Findings
While challenges to improving IT security remain, there is a trend towards better security preparedness and effectiveness.
• More than half (55 percent) of IT professionals surveyed said their organizations did not experience any security breaches in 2015, compared to 29 percent who did.
• 50 percent said their organizations are less vulnerable now than they were a year ago, compared to 12 percent who said they are more vulnerable. Furthermore:
o Nearly one-third (30 percent) said the number of IT security incidents their organizations experienced decreased in 2015 versus one-fifth (20 percent) who said they increased.
o More than one-third (36 percent) said their time to respond to a threat decreased in 2015 versus roughly a quarter (28 percent) who said it increased.
• Approximately half or more said it typically takes mere minutes for their organizations to detect the following threats:
o SQL injection attacks (47 percent)
o Exploitation of known vulnerabilities (50 percent)
o Misuse/abuse of credentials (47 percent)
o Rogue network device (52 percent)
o Security policy violations (47 percent)
Organizations whose security posture improved over the past year found success by implementing a handful of vital security technologies and best practices.
• Among those who said their organizations are now less vulnerable than they were a year ago, the top five reasons reported were:
1. Adoption of intrusion detection and prevention systems
2. Introduction or expanded the use of data encryption
3. Improved patch management
4. Implementation of log analysis, such as security information and event management (SIEM) tools
5. Improved or increased security training for company personnel
• Endpoint security software topped the list of the most important technologies or practices for ensuring IT security, with 83 percent identifying it as critical or very important, followed by patch management software (75 percent) and identity and access management tools (71 percent) to round out the top three.
• More than half also identified configuration management software (60 percent) and SIEM software (54 percent) as critical or very important to ensuring IT security.
Despite these positive developments, IT departments must still be vigilant against the threat and consequences of security breaches.
• Of those whose organizations experienced a security breach in 2015, 52 percent said the breaches were of medium to major severity.
• Nearly three-quarters (72 percent) of the organizations breached in 2015 store customer data, with more than one-third (36 percent) of those storing data on at least 100,000 customers.
• While just a quarter (24 percent) expect their organizations to suffer from a security breach in 2016, three-fourths (75 percent) of them store customer data, including 45 percent that store customer social security numbers.
• The increasing sophistication of attacks is the number one factor most commonly thought to make an organization more vulnerable (28 percent).
