Frost & Sullivan Report

Editor's Notes

1. Key results of the network Visibility Survey The survey asked questions about security breaches and the efficacy of certain network security tools. Pertaining to the breach environment, the IT professionals were asked how many security incidents their company experienced over the past 12 months by specific network components. The network components included managed end-user computers, managed servers, unmanaged bring your own devices (BYOD), smartphones/tablets, non-computing devices (IoT), physical intrusion, and network intrusion. The results were troubling. If all of the network components are added together, the percentage of networks that had five or more security incidents within the past 12 months was 72%. Continuous Monitoring and Threat Mitigation with Next-generation NAC- Frost & Sullivan – October 2016
2. “The results were troubling. If all of the network components are added together, the percentage of networks that had five or more security incidents within the past 12 months was 72%. Exhibit 1. Percentage of Networks that Experienced Five or More Security Incidents Within the Last 12 Months Germany United Kingdom United States All Countries in Survey 0% 20% 40% 83% 69% 67% 72% 60% 80% 100% Looking at the data more granularly, no network component is truly secure. Analyzing the percentage of companies that report at least five security incidents for each network component category, one clear message emerges from the survey data: both managed and unmanaged (BYOD) network components provide penetrable entry points to networks. Exhibit 2. Security Incidents Reported Within the Last 12 Months Source: Network Visibility Study, Frost & Sullivan, October 2015
3. The panel was asked if their networks suffered from a “significant” blind spot caused by certain network technology platforms. The resulting data is fairly clear. Regardless of the region or the technology, IT and security administrators stated their networks have significant blind spots (please see Exhibit 2). The survey indicates that better visibility is required, and communication between technologies is needed to shore up blind spots. Source: Continuous Monitoring and Threat Mitigation with Next-generation NAC- Frost & Sullivan – October 2016
4. Analyzing the percentage of companies that report at least five security incidents for each network component category, one clear message emerges from the survey data: both managed and unmanaged (BYOD) network components provide penetrable entry points to networks.
5. Many network security administrators use security and management agents to track endpoints on their networks. An agent is a small piece of code installed on an endpoint that associates the endpoint to the enterprise network. The advantage to using agents is that an endpoint is more easily recognized by the network and communications such as software updates are more easily facilitated between the endpoint and the network. However, there are three significant problems with agents. The first problem is that the majority of cyber security tools use a “polling” type of scan technology. Commonly, in vulnerability management (VM), security information and event management (SIEM), and other cyber technologies, semi-persistent scanning is initiated. This procedure works well for static devices that are attached by Ethernet to a network. However, as networks are designed to accommodate more mobile devices, much happens dynamically between polling events. Transient devices are easily lost. The second problem is that agents can be misconfigured or disabled. An enterprise network is often a fluid environment. Endpoints are frequently reconfigured and new office locations are dropped or added. If an agent is not functioning properly, the network loses visibility into the endpoint and security can be compromised. The second problem with reliance on security agents is that agents required by IT teams cannot be installed on the increasing number of personal (BYOD) and IoT devices on the enterprise network. Hence, reliance on agents means that the network isn’t aware of the fastest growing segment of endpoints coming onto the enterprise network and reduces the organization’s security posture. The last problem with security agents is reliance on security agents brings a false sense of security. In the Network Visibility Survey conducted by Frost & Sullivan, the survey asked security professionals about the confidence levels they had about the installed antivirus, mobile device management (MDM), encryption, and patch management agents they had on their networks. Source: Continuous Monitoring and Threat Mitigation with Next-generation NAC- Frost & Sullivan – October 2016
6. Recognizing that answers of “6” and “7” represent high or extreme confidence in agent installments, presented here are replies of 1 thru 5, which demonstrate a confidence that is less than “on point.” Many network security administrators use security and management agents to track endpoints on their networks. An agent is a small piece of code installed on an endpoint that associates the endpoint to the enterprise network. The advantage to using agents is that an endpoint is more easily recognized by the network and communications such as software updates are more easily facilitated between the endpoint and the network. However, there are three significant problems with agents. The first problem is that the majority of cyber security tools use a “polling” type of scan technology. Commonly, in vulnerability management (VM), security information and event management (SIEM), and other cyber technologies, semi-persistent scanning is initiated. This procedure works well for static devices that are attached by Ethernet to a network. However, as networks are designed to accommodate more mobile devices, much happens dynamically between polling events. Transient devices are easily lost. The second problem is that agents can be misconfigured or disabled. An enterprise network is often a fluid environment. Endpoints are frequently reconfigured and new office locations are dropped or added. If an agent is not functioning properly, the network loses visibility into the endpoint and security can be compromised. The second problem with reliance on security agents is that agents required by IT teams cannot be installed on the increasing number of personal (BYOD) and IoT devices on the enterprise network. Hence, reliance on agents means that the network isn’t aware of the fastest growing segment of endpoints coming onto the enterprise network and reduces the organization’s security posture. The last problem with security agents is reliance on security agents brings a false sense of security. In the Network Visibility Survey conducted by Frost & Sullivan, the survey asked security professionals about the confidence levels they had about the installed antivirus, mobile device management (MDM), encryption, and patch management agents they had on their networks. Recognizing that answers of “6” and “7” represent high or extreme confidence in agent installments, presented here are replies of 1 thru 5, which demonstrate a confidence that is less than “on point.” Source: Continuous Monitoring and Threat Mitigation with Next-generation NAC- Frost & Sullivan – October 2016
7. The increasing complexity of network and information security burdens security teams that are already overtaxed. Most organizations report that they have too few information security workers. Removing manual tasks through automation would seem to make sense, but there are questions about how willing security professionals are to embrace automation. So, the question was put to the survey respondents, “To what degree would your network benefit if they could automatically invoke a set of pre-determined security controls (network security technology)? The survey results indicate a Clarion call for security vendors to add more automation to their products. (Please see Exhibit 3.) Ideally, IT and security teams would like to be able to customize settings; however, a security tool has to be effective out of the box and has to remain effective when integrated with other tools in a layered cyber defense. Source: Continuous Monitoring and Threat Mitigation with Next-generation NAC- Frost & Sullivan – October 2016