Intel Security Report Details Challenges Slowing Response to Targeted Attacks

28% of Security Incidents Are Targeted Attacks; Product Integration, Event Comprehension, and Insufficient Skills Are Key Challenges to Timely Incident Response

SANTA CLARA, Calif.--(BUSINESS WIRE)-- A new report, Tackling Attack Detection and Incident Response, from Enterprise Strategy Group (ESG), commissioned by Intel Security, examines organizations’ security strategies, cyber-attack environment, incident response challenges and needs. The survey found that security professionals are inundated with security incidents, averaging 78 investigations per organization in the last year, with 28 percent of those incidents involving targeted attacks – one of the most dangerous and potentially damaging forms of cyber-attacks. According to the IT and security professionals surveyed, better detection tools, better analysis tools, and more training on how to deal with incident response issues are the top ways to improve the efficiency and effectiveness of the information security staff.

“When it comes to incident detection and response, time has an ominous correlation to potential damage,” said Jon Oltsik, senior principal analyst at ESG. “The longer it takes an organization to identify, investigate and respond to a cyber-attack, the more likely it is that their actions won’t be enough to preclude a costly breach of sensitive data. With this in mind, CISOs should remember that collecting and processing attack data is a means toward action -- improving threat detection and response effectiveness and efficiency.”

Better Integration

Nearly 80 percent of the people surveyed believe the lack of integration and communication between security tools creates bottlenecks and interferes with their ability to detect and respond to security threats. Real-time, comprehensive visibility is especially important for rapid response to targeted attacks, and 37 percent called for tighter integration between security intelligence and IT operations tools. In addition, the top time-consuming tasks involved scoping and taking action to minimize the impact of an attack, activities that can be accelerated by integration of tools. These responses suggest that the very common patchwork architectures of dozens of individual security products have created numerous silos of tools, consoles, processes and reports that prove very time consuming to use. These architectures are creating ever greater volumes of attack data that drown out relevant indicators of attack.

Better Comprehension

Security professionals surveyed claim that real-time security visibility suffers from limited understanding of user behavior and network, application and host behavior. While the top four types of data collected are network-related, and 30 percent collect user activity data, it’s clear that data capture isn’t sufficient. Users need more help to contextualize the data to understand what behavior is worrisome. This gap may explain why nearly half (47 percent) of organizations said determining the impact or scope of a security incident was particularly time consuming.

Better Analytics

Users understand they need help to evolve from simply collecting volumes of security event and threat intelligence data to more effectively making sense of the data and using it to detect and assess incidents. Fifty-eight percent said they need better detection tools, (such as static and dynamic analysis tools with cloud-based intelligence to analyze files for intent). Fifty-three percent say they need better analysis tools for turning security data into actionable intelligence. One-third (33 percent) called for better tools to baseline normal system behavior so teams can detect variances faster.

Better Expertise

People who took the survey admitted to a lack of knowledge of the threat landscape and security investigation skills, suggesting that even better visibility through technical integration or analytical capabilities will be inadequate if incident response teams cannot make sense of the information they see. For instance, only 45 percent of respondents consider themselves very knowledgeable about malware obfuscation techniques, and 40 percent called for more training to improve cybersecurity knowledge and skills.

Automation to Enhance Action

The volume of investigations and limited resources and skills contributed to a strong desire among respondents for help with incident detection and response. Forty-two percent reported that taking action to minimize the impact of an attack was one of their most time-consuming tasks. Twenty-seven percent would like better automated analytics from security intelligence tools to speed real-time comprehension; while 15 percent want automation of processes to free up staff for more important duties.

“Just as the medical profession must deliver heart-attack patients to the hospital within a ‘golden hour’ to maximize likelihood of survival, the security industry must work towards reducing the time it takes organizations to detect and deflect attacks, before damage is inflicted,” said Chris Young, General Manager at Intel Security. “This requires that we ask and answer tough questions on what is failing us, and evolve our thinking around how we do security.”

The ESG believes that there is a hidden story within the Intel Security research that hints at best practices and lessons learned. This data strongly suggests that CISOs:

• Create a tightly-integrated enterprise security technology architecture: CISOs must replace individual security point tools with an integrated security architecture. This strategy works to improve the sharing of attack information and cross-enterprise visibility into user, endpoint and network behavior, not to mention more effective, coordinated responses.
• Anchor their cybersecurity strategy with strong analytics, moving from volume to value: Cybersecurity strategies must be based upon strong security analytics. This means collecting, processing and analyzing massive amounts of internal (i.e., logs, flows, packets, endpoint forensics, static/dynamic malware analysis, organizational intelligence [i.e., user behavior, business behavior, etc.]) and external data (i.e., threat intelligence, vulnerability notifications, etc.).
• Automate incident detection and response whenever possible: Because organizations will always struggle to keep up with the most recent attack techniques, CISOs must commit to more automation such as advanced malware analytics, intelligent algorithms, machine learning and the consumption of threat intelligence to compare internal behavior with incidents of compromise (IoCs) and tactics, techniques and procedures (TTPs) used by cyber-adversaries.
• Commit to continuous cybersecurity education: CISOs should require ongoing cyber-education for their security teams, including an annual series of courses that provide individual professionals more depth of understanding of threats and best practices for efficient and effective incident response.

To view the full Intel Security report, please visit: http://www.mcafee.com/us/resources/reports/rp-esg-tackling-attack-detection-incident-response.pdf

Survey Methodology

Intel Security surveyed 700 IT and security professionals at mid-market (i.e. 500 to 999 employees) and enterprise (i.e. more than 1,000 employees) organizations located in Asia, North America, EMEA and South America. Respondents came from numerous industries with the largest respondent populations coming from information technology (19 percent), manufacturing and materials (13 percent), and financial services (9 percent).

About Intel Security

McAfee is now part of Intel Security. With its Security Connected strategy, innovative approach to hardware-enhanced security, and unique McAfee Global Threat Intelligence, Intel Security is intensively focused on developing proactive, proven security solutions and services that protect systems, networks, and mobile devices for business and personal use around the world. Intel Security is combining the experience and expertise of McAfee with the innovation and proven performance of Intel to make security an essential ingredient in every architecture and on every computing platform. The mission of Intel Security is to give everyone the confidence to live and work safely and securely in the digital world. www.intelsecurity.com.

Note: Intel, the Intel logo, McAfee and the McAfee logo are registered trademarks of Intel Corporation in the United States and other countries. Other names and brands may be claimed as the property of others.

About Enterprise Strategy Group

ESG is an integrated IT research, analyst, strategy, and validation firm that is world renowned for providing actionable insight and intelligence to the global IT community. ESG’s unique understanding of client needs is based on extensive interactions with end users, vendors, and channel partners. ESG has a 360° perspective, which ESG connects directly to its research proficiency and operational knowledge.

Intel Security
Chris Palm, 408-346-3089
[email protected]
or
Zeno Group
Janelle Dickerson, 650-801-0936
[email protected]

Source: Intel Security

You May Also Be Interested In

• Intel (INTC) PT Lowered to $40 at Susquehanna
• Boris Usherovich Revels in Centre Pompidou's Modern Art Collection: Insights on the Exhibition at CaixaForum Madrid
• Georgia Trust for Historic Preservation Presents 26 Statewide Preservation Awards at Ceremony in Athens