As the quantity and frequency of advanced threats continue to accelerate, a SANS Institute survey entitled, Effectively Addressing Advanced Threats has found that a continued lack of visibility and the complexity of managing data across both on-premise and cloud infrastructures is further complicating the battle against such threats.
Of the organisations surveyed, 74% have a blend of on-premise and cloud environments, in many cases using multiple cloud providers.
The survey, of 366 security and IT professionals across various industries worldwide, provides insights into how organisations deal with advanced threats and highlights key technology challenges and limitations that organisations are self-identifying in their efforts to detect and respond to highly sophisticated cyberattacks.
According to the findings, 48% of respondents said they lack visibility into what data and where data is being processed within the organisation. Access to sensitive data by insecure, unmanaged devices or individuals as well as a lack of geolocation information of the data were also identified as concerning blind spots.
When asked about the major barriers to detecting and remediating advanced threats, nearly half of the respondents emphasised an inability to understand or baseline normal user behaviour, with shortages in funding and resources coming in as a close second. Conversely, account or credential hijacking and privileged user abuse topped the list of major threats and risks realised within respondents’ environments.
The survey, which was sponsored by IBM Security, also looked at the challenges that respondents face within their cloud infrastructures, and found that a lack of visibility remains at the core of their limitations. When it comes to major gaps in the security analytics of their cloud-based infrastructure, survey found:
- More than half of the respondents have concerns about integrating data with analytics tools and combining data across cloud environments
- Nearly 55% struggle with a lack of integration between current security analytics tools and cloud infrastructure
- Approximately 43% face a lack of threat insights targeting cloud environments.
Endpoint alerts and network access devices are the top sources of incident information, providing alerts and investigation support, respectively.
“Clearly, visibility of data, users, devices and the cloud environment are playing a critical role in how and whether security professionals can fight advanced threats effectively,” said SANS instructor and survey author Matt Bromiley.
“While many tools such as security analytics are available to the security community, implementing them is dependent on understanding the organisation’s environment.”
