Enterprises plan on increasing their security budgets in the next year too. However, the key to preventing breaches relies upon accurately identifying and remediating gaps in current security defenses.
By: Stephan Chenette, co-founder and CTO, AttackIQ
Based on a survey of 577 IT and IT security practitioners in the United States from the Ponemon Institute, AttackIQ has released a new report, The Cybersecurity Illusion: The Emperor Has No Clothes. The report’s title is inspired by Hans Christian Andersen’s short tale,The Emperor’s New Clothes, since the findings demonstrate many IT professionals simply don’t know whether the security tools they have in place are actually effective. Findings also show that enterprises across industries are spending an annual average of $18.4 million to support cybersecurity efforts, yet data breaches persist. In fact, there were reportedly 110 total breaches affecting organizations across all industries in July 2019 alone that exposed over 104.5 million records, according to findings from the Identity Theft Resource Center. Much like the emperor in Andersen’s tale, companies are willing to spend top dollar on advanced security solutions, but don’t have visibility into them, leaving them “naked” and vulnerable to breaches.
Enterprises spend far too much money on an average of 47 different cybersecurity solutions without knowing if they are effective. In fact, 58 percent of organizations plan to increase the budget allocated toward cybersecurity by an average of 14 percent in the next year even though over half of the experts surveyed admit they are in the dark about how well the technologies they have are working, which is disturbing considering these organizations rely on these solutions to protect sensitive data including customers’ personally identifiable information (PII).
Organizations must be certain their security measures can effectively prevent critical infrastructure disruption. In order for enterprises to prevent data breaches, they must be able to accurately identify and remediate gaps in their security defenses. This is best accomplished by leveraging continuous security validation (CSV) platforms. With CSV technologies, enterprises can identify gaps, protection failures like misconfigurations, and validate the capabilities of current security solutions they employ are actually working as intended.
Premier CSV platforms operationalize the industry standard MITRE ATT&CK framework to systematically test the efficacy of companies’ security programs. MITRE ATT&CK is a globally-accessible knowledge base of threat actor tactics, techniques and procedures (TTPs) that have been assembled for use as a foundation for the development of specific threat models.
In addition, CSV technologies help consolidate and streamline security technologies within a security program by finding redundant technologies. CSV helps optimize each technology to make sure a security program is operating at its highest potential, providing visibility and helping strategic leaders a decision framework. By taking the guesswork out of measuring the effectiveness of their cybersecurity strategy, enterprises can save money, maximize ROI from their security tools and gain peace of mind that they are, in fact, protected.
About the Author
Stephan Chenette is the Founder and CTO of AttackIQ. Chenette is a 20 year information security veteran, servicing clients that range from startups to multinational corporations as a pentester, security and risk consultant, solutions architect and head of research and development. Chenette has presented at numerous conferences including RSA, Blackhat, ToorCon, BSides, CanSecWest, RECon, AusCERT, SecTor, SOURCE and PacSec
;
We are in our 11th year, and Global InfoSec Awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.