SC Magazine & ForeScout Survey Results
•
1 like•657 views
Enterprise CISOs Demand More Integration & Automation From Their Existing IT Security Tools
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to SC Magazine & ForeScout Survey Results
Similar to SC Magazine & ForeScout Survey Results (20)
Recently uploaded
Recently uploaded (20)
SC Magazine & ForeScout Survey Results
- 2. © 2015 ForeScout Technologies, Page 2 • How well are IT security managers’ needs being met? – Collaboration between IT security systems – Automation of security controls – Continuous monitoring and mitigation • Finding: Huge gulf between expectation and reality
- 3. © 2015 ForeScout Technologies, Page 3 FIREWALL SIEM ATD ENDPOINT EMMVA PATCH IBM IBM
- 4. © 2015 ForeScout Technologies, Page 4 Gartner, “Designing an Adaptive Security Architecture for Protection From Advanced Attacks”, Neil MacDonald and Peter Firstbrook, 12 February 2014, refreshed November 19, 2014 “The end result should not be 12 silos of disparate information security solutions. The end goal should be that these different capabilities integrate and share information to build a security protection system that is more adaptive and intelligent overall.” Figure 1. The Four Stages of an Adaptive Protection Architecture Source: Gartner (February 2014)
- 5. © 2015 ForeScout Technologies, Page 5 • 345 corporate executives and consultants with information security responsibility • North America • Diverse industries: Technology, financial, government, healthcare, education, manufacturing, utilities, retail
- 6. © 2015 ForeScout Technologies, Page 6 “How many security systems (such as, antivirus, mobile device management, vulnerability assessment, firewall, intrusion prevention, web security, email security, encryption, SIEM, data loss prevention, etc.) do you own?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study. Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention 13Or more security systems
- 7. © 2015 ForeScout Technologies, Page 7 “Disregarding your SIEM (if you have one), how many of your security and IT management systems directly share security-related context or control information with one another?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study. Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention 1to 3directly share security-related context
- 8. © 2015 ForeScout Technologies, Page 8 “How many of your existing security systems (such as, vulnerability assessment, network behavior analysis, etc.) and risk analysis systems (such as SIEM solutions) can mitigate risk /threats or remediate problems?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study. Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention 1to 3can mitigate risks or remediate problems
- 9. © 2015 ForeScout Technologies, Page 9 “How helpful would it be if your IT security and management systems were to share information about devices, applications, users, and vulnerabilities on your network?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study. Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention 95% “Helpful or Very Helpful”
- 10. © 2015 ForeScout Technologies, Page 10 “How helpful would it be if the majority of your security systems and risk analysis systems were linked to automated security controls, such as firewalls, network access control or patch management systems?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study. Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention 93% “Helpful or Very Helpful”
- 11. © 2015 ForeScout Technologies, Page 11 1. Current state – Many different IT security systems are being used – Information sharing between systems is rare – Automated mitigation is rare 2. Desired state – Strongly desire more information sharing – Strongly desire more automated mitigation Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM Data loss prevention The Gap Is Huge
- 12. © 2015 ForeScout Technologies, Page 12 “More integrated controls would help our IT organization identify, investigate, respond and resolve security incidents” Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 97% Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study.
- 13. © 2015 ForeScout Technologies, Page 13 “More integrated controls would help our IT organization identify, investigate, respond and resolve security incidents” “Automated security controls would have allowed us to avoid a compromise or reduce the impact of the compromise that we experienced in the last year” Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 97% Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 57% Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study.
- 14. © 2015 ForeScout Technologies, Page 14 “More integrated controls would help our IT organization identify, investigate, respond and resolve security incidents” “Automated security controls would have allowed us to avoid a compromise or reduce the impact of the compromise that we experienced in the last year” “Automated security controls will help prevent future compromise” Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 97% Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 57% Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 78% Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study.
- 15. © 2015 ForeScout Technologies, Page 15 “Are your security processes (e.g. assessment and patching) mainly done on a periodic basis (weekly, monthly, etc.) or mainly done continuously?” “Continuous”Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 43% Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study.
- 16. © 2015 ForeScout Technologies, Page 16 “Are your security processes (e.g. assessment and patching) mainly done on a periodic basis (weekly, monthly, etc.) or mainly done continuously?” “Continuous” “Planning to shift toward continuous in the next 12 to 24 months” Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 43% Antivirus Mobile device management Vulnerability assessment Firewall Intrusion prevention Web security Email security Encryption SIEM 64% “Is your organization planning to shift your security processes toward more continuous monitoring and mitigation?” Answers were obtained by SC Magazine as part of 2015 IT Security Collaboration Market Study.
- 17. © 2015 ForeScout Technologies, Page 17 IT Security Managers Reality • Strongly want IT security products to share information • Very few IT security products share information
- 18. © 2015 ForeScout Technologies, Page 18 IT Security Managers Reality • Strongly want IT security products to share information • Strongly want IT security products to automatically mitigate threats • Very few IT security products share information • Very few products automatically mitigate
- 19. © 2015 ForeScout Technologies, Page 19 IT Security Managers Reality • Strongly want IT security products to share information • Strongly want IT security products to automatically mitigate threats • Continuous monitoring and mitigation • Very few IT security products share information • Very few products automatically mitigate • Slightly less than half of organizations practice continuous monitoring
- 20. © 2015 ForeScout Technologies, Page 20 IT Security Managers Reality • Strongly want IT security products to share information • Strongly want IT security products to automatically mitigate threats • Continuous monitoring and mitigation • Very few IT security products share information • Very few products automatically mitigate • Slightly less than half of organizations practice continuous monitoring GAP
- 22. © 2015 ForeScout Technologies, Page 22
Editor's Notes
- Thank you. We are pleased to present the results of this market research which had some very interesting results.
- And if I can summarize what we found in one sentence, it it was that there is a huge gulf between IT managers’ expectations and reality. I’ll share the details with you in just a minute.
- The study was primarily designed to explore this issue of collaboration. You can see various types of security products listed on this slide, from various different vendors. [CLICK TO ADVANCE] These logos are representative of the products in each category. How many of these products are talking with one another? We wanted to find out because we think it is and important issue. And it is not just ForeScout who thinks it is important.
- Gartner also thinks it is important. About a year ago, they came out with a security model that they call the Adaptive Security Architecture. They recommend that every enterprises have twelve different categories of security capability. Going around this chart in a clockwise direction, you can see that some of the capabilities are intended to help predict whether your organization is going to be attacked, some will help you prevent a security breach, some will help you detect a security breach, and some will help you respond to a security breach. Different categories of products, somewhat like I showed you on the last slide. But Gartner said that the end result should not be 12 silos of disparate information security solutions. The end goal should be that these different capabilities integrate and share information to build a security protection system that is more adaptive and intelligent overall.
- So ForeScout worked with SC Magazine to conduct a market study, and we surveyed 345 corporate executives and consultants in North America. OK, so let’s get into it. What did we find out?
- The first question that we asked was: How many IT security systems do you own? And the answer was quite a few. Over half of the large enterprises, which we defined as organizations with over $1 billion in annual revenue, said that they had 13 or more security systems.
- Then we asked – how many of your IT security systems share information with each other? The majority of respondents said very few, just 1 to 3 systems directly shared security information.
- Then we asked: “How many of Your IT Security Systems Can Automatically Mitigate Risk Or Remediate Problems?” Again, the majority of respondents said between 1 and 3 of their existing systems could do this.
- So next we wanted to find out how important IT security managers believe that information sharing would be. It’s one thing for ForeScout and Gartner to say it is helpful, but we wanted to hear from customers. So we asked the question. Here we found a huge percentage – 95% of respondents said that it would be helpful or very helpful.
- We asked the same question about automation. Again we found a huge percentage – 93% of large enterprise customers said that it would be helpful or very helpful.
- So let me summarize the results so far. We found a huge gap between the current state and the desired state. Few systems are sharing information, and few systems can initiate automated risk mitigation actions, despite the fact that this is exactly what enterprise IT managers what to happen.
- Now let me move on and present some other results of the survey. We asked respondents: “why is more IT security system collaboration helpful?” We received a variety of rsponses. 97% said that more integrated controls would help identify, investigate, respond and resolve security incidents.
- 57% said that Automated security controls would have allowed the organization to avoid a compromise or reduce the impact of the compromise that they experienced in the last year
- And 75% said that more automation would help prevent future compromise. These answers were not mutually exclusive, which is why the totals add up to more than 100%. We wanted to get reactions to each of these statements.
- 43% or respondents said that their security processes are continous
- 64% said that they were planning to shift towards continuous monitoring in the next 12 to 24 months.
- So those were the major conclusions of the market study. TO summarize: We found that IT security managers strongly want their products to share information, but few do.
- We found that IT security managers want automated controls, but few products can do this.
- And we found that with respect to continuous monitoring and mitigation, slightly less than half of the organizations were practicing this today, but most organizations were planning to do this in the future.
- And we found a large gap between desire and reality.