Symantec 2011 Threat Management Survey Global Results
-
Upload
symantec -
Category
Technology
-
view
1.189 -
download
5
Transcript of Symantec 2011 Threat Management Survey Global Results
Methodology
• Survey performed by Applied Research
• 1,025 global enterprises
• Tactical IT, Strategic IT and C-level professionals
• Cross-industry
2
Key Findings
• Enterprises not confident in their security posture
• Organizations struggling with timely analysis and response
• Top concerns are security intelligence and visibility
• Staffing problems top list of issues impacting ability to respond to new and emerging threats
3
Security Confidence
• 57% lack confidence in IT security staffs’ ability to respond to new threats
• Why? Several of the factors tied to staffing
– Not enough staff
– Staff lacks time
4
Staffing Issues
• 66% rate staff as less than effective
• Only 4% rate staff as completely effective
• Why?
– Recruiting
– Retention
– Right skill sets
Security Shortcomings
• Timely and quality alert correlation/analysis
• Timely and effective event response
7
Symantec Recommendations
• Build a comprehensive incident management program
• Be vigilant about the changing threat landscape
• Broaden the visibility across your infrastructure
• Evaluate systems for managing security information and alerts
11
33%
33%
34%
0% 5% 10% 15% 20% 25% 30% 35% 40%
1,000 to 2,499
2,500 to 4,999
5,000 or more
Q2: How many employees does your organization have in all locations worldwide?
12
10%
10%
10%
10%
10%
9%
6%
5%
4%
4%
4%
3%
3%
3%
2%
2%
2%
2%
1%
0% 2% 4% 6% 8% 10% 12%
Finance and Insurance
Information Technology and Communications
Scientific research, professional and technical services
Wholesale and Retail
Other
Manufacturing
Medical, Health Care and Welfare
Construction
Education, Learning and Support
Government
Real estate and goods rental and leasing
Eating and drinking services, accommodations
Internet
Transport and freight service (cover such as Airline/railway industry)
Energy
Legal
Living-related and personal services and amusement services
Media
Advertisement
Q3: What is your organization's primary industry?
13
25%
25%
25%
25%
0% 5% 10% 15% 20% 25% 30%
C-level or business owner
Management role in IT, primarily focused on strategic issues
Management role in IT, primarily focused on tactical/operational issues
Manage our computing resources
Q4: What is your primary role?
14
2%
3%
1%
25%
5%
1%
4%
9%
22%
12%
3%
3%
11%
0% 5% 10% 15% 20% 25% 30%
President
Owner
Partner
CIO
CTO
CISO
Vice President or Senior Vice President in a computing area
Director in a computing area
Manager of Information Systems or Computer Systems
Systems analyst
Systems architect
Systems designer
Other
Q5: What is your title?
17
12.88
12
0
2
4
6
8
10
12
14
Mean Median
Q8: How many years have you been working in computer systems and technology?
18
2%
3%
4%
5%
9%
15%
16%
16%
16%
7%
7%
0% 2% 4% 6% 8% 10% 12% 14% 16% 18%
Less than $500,000
$500,000 to $2,000,000
$2,000,000 to $7,500,000
$7,500,000 to $30,000,000
$30,000,000 to $100,000,000
$100,000,000 to $500,000,000
$500,000,000 to $1,500,000,000
$1,500,000,000 to $5,000,000,000
$5,000,000,000 to $25,000,000,000
$25,000,000,000 to $100,000,000,000
More than $100,000,000,000
Q9: What are your company's annual revenues?
19
1%
9%
4%
11%
31%
29%
7%
5%
0%
3%
0% 5% 10% 15% 20% 25% 30% 35%
Declining 25% per year or greater
Declining at between 10 to 24% per year
Declining at between 1 to 9% per year
Flat: Neither growing nor declining
Growing at between 1 to 9% per year
Growing at between 10 to 24% per year
Growing at 25 to 49% per year
Growing at 50 to 99% per year
Growing at 100% per year or more
Decline to state
Q10: Characterize your company's year-over-year annual growth rate in terms of annual revenue:
21
20%
18%
19%
25%
19%
0% 5% 10% 15% 20% 25% 30%
Very concerned
Somewhat concerned
Neutral
Somewhat confident
Very confident
Q213: How confident are you that your IT security staff can handle new security threats in a timely and effective manner?
22
46%
45%
45%
45%
43%
39%
36%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%
Insufficient security staff
Not enough visibility into security across entire infrastructure
Trouble correlating/analyzing security alerts as they are happening
Staff doesn't have enough time
Trouble responding to security incidents in a timely/effective manner
Security staff lacks necessary experience/skill sets
No access to latest information about new threats, vulnerabilities, etc.
Q214: What are the top three factors that are keeping you from being completely confident in your ability to handle new security
threats in a timely and effective manner? (Ranked 1, 2, or 3)
24
13%
23% 27%
38% 19%
28% 28%
25%
27%
25%
28% 20%
41%
24% 17% 18%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Security intelligence Security visibility Attack analysis Security response
Q215: Please review the following aspects of security and rank them in terms of what concerns you the most.
1
2
3
4
25
2.04
2.50 2.64
2.82
0
1
2
3
4
Security intelligence Security visibility Attack analysis Security response
Q215: Please review the following aspects of security and rank them in terms of what concerns you the most.
(Average Ranks)
26
15% 21%
26%
38%
19%
28%
29%
24% 29%
26%
25%
21%
38%
26% 19% 17%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Security intelligence Security visibility Attack analysis Security response
Q216: Please rank these aspects in terms of your organization's ability to execute.
1
2
3
4
27
2.10
2.44
2.62 2.83
0
1
2
3
4
Security intelligence Security visibility Attack analysis Security response
Q216: Please rank these aspects in terms of your organization's ability to execute. (Average Ranks)
28
3% 1%
7% 5%
25% 26%
41% 40%
24% 27%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Acquiring such intelligence in a timely fashion The quality of intelligence you gather
Q217: When it comes to keeping up with the latest cyber-security vulnerabilities and threats, please rate how you are doing in the
following areas:
1 - Extremely poor 2 - Somewhat poor 3 - Neither poor nor well 4 - Somewhat well 5 - Extremely well
29
65%
68%
0% 10% 20% 30% 40% 50% 60% 70% 80%
Acquiring such intelligence in a timely fashion
The quality of intelligence you gather
Q217: When it comes to keeping up with the latest cyber-security vulnerabilities and threats, please rate how you are doing in the
following areas. (Somewhat/Extremely well)
30
10%
6%
0% 2% 4% 6% 8% 10% 12%
Acquiring such intelligence in a timely fashion
The quality of intelligence you gather
Q217: When it comes to keeping up with the latest cyber-security vulnerabilities and threats, please rate how you are doing in the
following areas. (Somewhat/Extremely poorly)
31
1% 1% 1% 6% 7% 7%
27% 27% 27%
39% 44% 42%
27% 21% 22%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
The quality of that visibility Acquiring such visibility in a timely fashion How comprehensive the visibility is
Q218: When it comes to maintaining visibility into security across the entire company's infrastructure, please rate how you are doing
in each of the following areas:
1 - Extremely poor 2 - Somewhat poor 3 - Neither poor nor well 4 - Somewhat well 5 - Extremely well
32
66%
65%
65%
0% 10% 20% 30% 40% 50% 60% 70%
The quality of that visibility
Acquiring such visibility in a timely fashion
How comprehensive the visibility is
Q218: When it comes to maintaining visibility into security across the entire company's infrastructure, please rate how you are doing
in each of the following areas. (Somewhat/Extremely well)
33
7%
8%
8%
0% 1% 2% 3% 4% 5% 6% 7% 8% 9%
The quality of that visibility
Acquiring such visibility in a timely fashion
How comprehensive the visibility is
Q218: When it comes to maintaining visibility into security across the entire company's infrastructure, please rate how you are doing
in each of the following areas. (Somewhat/Extremely poorly)
34
1% 1% 5% 5%
27% 26%
42% 41%
25% 27%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
The timeliness of correlation and analysis The quality of the correlation and analysis
Q219: When it comes to your organization's ability to correlate and analyze security alerts across the enterprise, please rate how you
are doing in each of the following areas:
1 - Extremely poor 2 - Somewhat poor 3 - Neither poor nor well 4 - Somewhat well 5 - Extremely well
35
67%
68%
0% 10% 20% 30% 40% 50% 60% 70% 80%
The timeliness of correlation and analysis
The quality of the correlation and analysis
Q219: When it comes to your organization's ability to correlate and analyze security alerts across the enterprise, please rate how you
are doing in each of the following areas. (Somewhat/Extremely well)
36
7%
6%
0% 1% 2% 3% 4% 5% 6% 7%
The timeliness of correlation and analysis
The quality of the correlation and analysis
Q219: When it comes to your organization's ability to correlate and analyze security alerts across the enterprise, please rate how you
are doing in each of the following areas. (Somewhat/Extremely poorly)
37
1% 1% 5% 5%
24% 25%
45% 42%
25% 28%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Ability to respond in a timely fashion The effectiveness of your response
Q220: When it comes to your organization's ability to respond to security events, please rate how you are doing in each of the
following areas:
1 - Extremely poor 2 - Somewhat poor 3 - Neither poor nor well 4 - Somewhat well 5 - Extremely well
38
70%
69%
0% 10% 20% 30% 40% 50% 60% 70% 80%
Ability to respond in a timely fashion
The effectiveness of your response
Q220: When it comes to your organization's ability to respond to security events, please rate how you are doing in each of the
following areas. (Somewhat/Extremely well)
39
7%
6%
0% 1% 2% 3% 4% 5% 6% 7%
Ability to respond in a timely fashion
The effectiveness of your response
Q220: When it comes to your organization's ability to respond to security events, please rate how you are doing in each of the
following areas. (Somewhat/Extremely poorly)
41
11%
32%
41%
11%
4%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
We are extremely understaffed
We are somewhat understaffed
We have just enough security staff
We are somewhat overstaffed
We are extremely overstaffed
Q221: How would you characterize your security staffing levels at the current time?
42
10%
15%
24%
42%
10%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
Completely ineffective
Somewhat ineffective
Not as good as we would like, but not horrible
Mostly effective
Completely effective
Q222: Overall, how would you rate the effectiveness of your IT security staff?
43
10% 9% 11% 15%
27% 29% 12% 17% 15%
22%
15% 19%
15%
18% 21%
16% 14%
16%
18%
15% 18%
13%
16%
20%
17%
23% 18% 18%
14%
10% 29%
19% 17% 16% 14% 6%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Recruiting Retention Skill sets Experience Staff retirement Awareness
Q223: What is keeping you from rating your security staffing as "completely effective?" Rank the following areas of cyber security
staffing in terms of difficulty for your organization.
1
2
3
4
5
6
44
2.93 3.18
3.29 3.56
3.85
4.19
0
1
2
3
4
5
6
Recruiting Retention Skill sets Experience Staff retirement Awareness
Q223: What is keeping you from rating your security staffing as "completely effective?" Rank the following areas of cyber security
staffing in terms of difficulty for your organization. (Average Ranks)
46
40%
39%
30%
29%
24%
17%
16%
5%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
Symantec
IBM/ISS
AT&T
Dell/SecureWorks
Verizon Business
We don't use a managed security service provider
BT/Counterpane
Other (Please specify)
Q224: What managed security service provider vendors are you considering using or do you currently use?
(Mark all that apply.)
47
10%
14%
28%
35%
13%
0% 5% 10% 15% 20% 25% 30% 35% 40%
Absolutely no influence
Very little influence
Neutral
A moderate influence
Complete influence
Q225: How much influence does your managed security service provider have over which security products your company
purchases?
49
55%
34%
22%
19%
16%
1%
0% 10% 20% 30% 40% 50% 60%
Symantec
HP/ArcSight
EMC/RSA (enVision)
We don't use a SIEM
Q1 Labs
Other (Please specify)
Q226: What Security Information and Event Management (SIEM) vendors do you currently use?
(Mark all that apply.)
50
19% 13% 13% 12% 14% 15% 12% 11%
17% 23% 23% 22% 20% 19% 21% 22%
28% 30% 30% 31% 28% 29% 29% 31%
27% 25% 23% 24% 26% 26% 24% 22%
9% 10% 12% 11% 12% 11% 14% 14%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Insufficient staff to set up
Trouble integrating latest
information on new threats,
vulnerabilities, etc.
Staff doesn't have enough time
Trouble maintaining SIEM
rules to correlate/analyze alerts in real time
Insufficient staff to maintain
Trouble responding to incidents in
timely/effective manner
Insufficient training to set up
Insufficient training to maintain
Q227: How do the following challenges impact your ability to realize the full value of your Security Information and Event Management
(SIEM) solution?
1 - Extreme impact 2 - Moderate impact 3 - Some impact 4 - Slight impact 5 - No impact whatsoever
51
36%
36%
35%
34%
34%
34%
34%
33%
0% 5% 10% 15% 20% 25% 30% 35% 40%
Insufficient staff to set up
Trouble integrating latest information on new threats, vulnerabilities, etc.
Staff doesn't have enough time
Trouble maintaining SIEM rules to correlate/analyze alerts in real time
Insufficient staff to maintain
Trouble responding to incidents in timely/effective manner
Insufficient training to set up
Insufficient training to maintain
Q227: How do the following challenges impact your ability to realize the full value of your Security Information and Event Management
(SIEM) solution? (Moderate/Extreme impact)
52
36%
35%
35%
35%
38%
37%
38%
36%
0% 5% 10% 15% 20% 25% 30% 35% 40% 45%
Insufficient staff to set up
Trouble integrating latest information on new threats, vulnerabilities, etc.
Staff doesn't have enough time
Trouble maintaining SIEM rules to correlate/analyze alerts in real time
Insufficient staff to maintain
Trouble responding to incidents in timely/effective manner
Insufficient training to set up
Insufficient training to maintain
Q227: How do the following challenges impact your ability to realize the full value of your Security Information and Event Management
(SIEM) solution? (Slight/No impact)