“48% of cyber attacks breach UK organisations’ defences” reports Tenable

With circa 60% of UK organisations confident that their cyber security practices are capable of successfully reducing their risk exposure, there’s obviously much work still to be transacted.

These and other key findings are based on the results of a commissioned survey of over 800 cyber sector professionals – among them 100 UK-based cyber security and IT leaders – conducted this year by Forrester Consulting on behalf of Tenable.

Respondents were particularly concerned about the risks associated with cloud infrastructure, given the complexity it introduces in trying to correlate user and system identities, access and entitlement data. Seven-in-ten organisations affirmed that they use multi-cloud and/or hybrid cloud environments. However, over two-thirds of respondents (67%, in fact) cite cloud infrastructure as one of the highest areas of risk exposure in their organisation.

In order, the highest perceived risks emanate from the use of public cloud infrastructure (31%), multi-cloud and/or hybrid cloud (27%) and private cloud infrastructure (9%).

From the study findings, it’s evident that time is not on the side of security teams. Nearly two-thirds of respondents (65%) believe their organisation would be more successful at defending against cyber attacks if more resources were directed towards preventive cyber security measures. Six-in-ten respondents (60%) stated that the cyber security team is too busy fighting critical incidents to take a preventive approach towards reducing their organisation’s exposure.

Accurate picture

Cyber professionals note that a reactive stance is largely due to their organisations’ ongoing struggle to obtain an accurate picture of the attack surface, including visibility into unknown assets, cloud resources, code weaknesses and user entitlement systems.

The complexity of infrastructure – with its reliance on multiple cloud systems, numerous identity and privilege management tools and various web-facing assets – brings with it numerous opportunities for misconfigurations and overlooked assets. Over half of respondents (56%) said that a lack of data hygiene prevents them from drawing quality data from user privilege and access management systems, as well as from vulnerability management systems.

While most respondents (75%) consider user identity and access privileges when they prioritise vulnerabilities for patching/remediation, 46% explained that their organisation lacks an effective way of integrating such data into their preventive cyber security and exposure management practices.

A lack of communication at the highest levels complicates and compounds the cyber problem in businesses. While attackers are continuously assessing environments, in most organisations meetings about business-critical systems take place on a monthly frequency at best. Just under half of respondents (47%) say they meet monthly with business leaders to discuss which systems are business-critical, while 25% hold such meetings only once every year. In fact, 3% of respondents never hold such meetings.

Overwhelmed by volume

“While reducing cyber risks has to be the priority,” observed Bernard Montel, EMEA technical director and security strategist at Tenable, “that task seems to be far easier said than done. Our study confirms that security teams are being overwhelmed by the sheer volume of cyber attacks to which they must react. As the attack surface becomes ever more complex, this imbalance will only worsen.”

Montel added: “Something has to change in order to stem the tide of successful attacks. Security leadership needs to be involved in high-end business decision-making. Only then can the organisation hope to reduce its risks and take steps to address the challenges that are standing in the way.”

A whitepaper is available with further results from the study, including how organisations can address the challenges and move from a reactive security posture to a preventive approach.

*Further information is available online at www.tenable.com