Incomplete visibility a top security failing

Real-world breaches and security incidents continue to show that many of the most widespread issues still stem from a lack of basic cyber hygiene, according to a report by security firm Tripwire.

Therefore, organisations cannot overlook the fundamentals such as addressing known vulnerabilities, ensuring secure configuration and monitoring systems for change, the report said.

A key finding of the report based on a survey of more than 300 security professionals is that many organisations still struggle to maintain the adequate visibility into their environments needed to address potential issues quickly.

Attackers may only need minutes on a network to launch a successful attack, the report said, yet 57% of respondents said it takes hours, weeks, months or longer to detect new devices connecting to their organisation’s network.

The survey shows that organisations need to improve visibility into the devices and software on their networks, logs from critical systems and configuration changes.

More than half (54%) of respondents are not collecting logs from all critical systems into a central location, and 97% believe they need to get more efficient at checking logs. About a quarter said they were not efficient at all, while another 73% said they were fairly efficient, but could improve.

The report also highlights that vulnerability scans are not as extensive as they should be, with only half of respondents running comprehensive, authenticated scans and only 59% scanning weekly – or more in line with industry best practice.

Hardening benchmarks are also a missed opportunity, the report said, with 60% of respondents admitting they do not use hardening benchmarks such as those provided by the US Center for Internet Security (CIS) and Defense Information Systems Agency (DISA) to establish a secure baseline.

While many security teams implement good basic protections around administrative privileges, the report said these low-hanging-fruit controls should be in place at more organisations, with 31% of organisations still not requiring default passwords to be changed, and 41% still not using multifactor authentication for accessing administrative accounts.

Organisations can start to build up cyber hygiene by following established best practices such as the Critical Security Controls, a prioritised set of steps maintained by the CIS. Although there are 20 controls, the report said implementing just the top six establishes what CIS calls “cyber hygiene.”

“Industry standards are one way to leverage the broader community, which is important with the resource constraints that most organisations experience,” said Tim Erlin, vice-president of product management and strategy at Tripwire.

“It’s surprising that so many respondents aren’t using established frameworks to provide a baseline for measuring their security posture. It’s vital to get a clear picture of where you are so you can plan a path forward.”