The majority of enterprises seeking to develop their security strategy for 2013 are highly reliant on the annual threat reports compiled by security and Internet-service firms.
So says a new survey conducted by security-services firm Solutionary, which found that nearly seven out of every eight companies use the global threat reports created by firms such as McAfee, Microsoft, Symantec and Verizon to guide their security strategies.
Almost 80 percent of the security professionals who responded to the survey use annual threat data to support their requests for budget increases.
By creating reports that are more useful for their customers, security software specialists and service providers can benefit by helping their customers’ security teams successfully argue for budget hikes, said Rob Kraus, director of research for the Solutionary Engineering Research Team.
Solutionary conducted the survey to guide the creation of its own global threat intelligence report, gathering feedback on what its customers would like to see in their report. Nearly 180 companies responded to the questionnaire, but not all companies answered every question. There were a number of surprises, Kraus said.
Nearly nine out of 10 companies that do not currently use global threat reports in their security process would use the documents if there were more guidance on how to garner more budget for their security teams, Kraus said. The most important topic is how to conduct self-assessments and show companies’ current weaknesses, according to more than 40 percent of surveyed companies.
“The security professionals we have out there are fighting the fight and doing a good job, but maybe they don’t have the culture of security built into their environment so much that they actually need more guidance on how to secure that funding,” Kraus said. “That’s a staggering number.”
In the past, compliance has driven budgets for security, but increasingly companies are looking to improve their security posture, not just follow the letter of compliance regulations, he said. For example, this year a growing number of organisations asked Solutionary for help analysing malware, an activity not required by compliance regulations.
The most useful part of threat reports is the executive summaries, according to a fifth of the companies surveyed. Kraus argues that these shortened versions of reports are sent to executives to help make arguments for more money. About one-sixth of companies identified statistics on global threats as the most important information, and slightly less than that sought out specifics on identified threats.
The biggest threat on the radar for 2013 is the bring your own device (BYOD) trend, said Kraus. While companies gain productivity and lower costs when employees use their own information devices, they lack the security controls typically enforced on internal devices. In addition, distributed denial-of-service attacks are increasingly being used to mask other aspects of an attack.
“The culture of security needs to be ingrained in your organization, and it is not going to happen overnight,” Kraus said. “Security is a team sport, and we all need to know that we need to overcome the obstacles in regards to funding.”
Are you a security pro? Try our quiz!
Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector
Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…
Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…
Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…
Explore the future of work with the Silicon In Focus Podcast. Discover how AI is…
Executive hits out at the DoJ's “staggering proposal” to force Google to sell off its…
View Comments
The individual assessment of security threats for each company has to be the most important thing as Kraus says. Companies shouldn't rely solely on threat reports as the CFOs need more specific information or they won't take it seriously after long - they need specifics. There are many aspects to consider ( http://ow.ly/grLix ) and the process will be difficult at first but the added credibility it will gain the CIO will be invaluable in the long run.