Enterprises challenged with security basics

Enterprises are challenged with security basics, according to the first Security leaders’ peer report commissioned by controls management provider Panaseer.

The report is based on a poll of 200 UK enterprise security leaders by Censuswide, which reveals concerns about visibility and access to trusted data leaving organisations open to attack.

The survey shows that many security leaders do not have visibility across a multitude of security technologies, with 89% of security leaders at large enterprises saying they are struggling with visibility and insight into trusted data. 

Nearly a third (31%) said they are concerned that a lack of visibility will impact their ability to comply with data protection and other security-related regulations. 

Complex and fragmented IT environments have compounded the visibility challenges for security teams, the report said. These issues are being exacerbated by the large number of security tools in use. On average, enterprise security teams are struggling to manage an average of 57.1 security tools. More than a quarter of respondents (26.5%) claimed to be running 76 or more security tools across their organisation.

The survey, which was aimed at getting insight into the key challenges security teams face in understanding their true cyber security posture, indicates that as well as obfuscating visibility, many security tools are not necessarily helping to make the organisation safer. 

When asked about the key drivers for new security initiatives and tools, the majority of respondents (55%) cited external factors such as regulations and internal factors (32%) such as board-led initiatives. However, when asked how effective the current security tools were, nearly three-quarters (70.5%) of security leaders admitted that they do not evaluate a security tool based on its impact on reducing cyber risk.

“Ultimately organisations are buying tools and not switching them on, because they lack visibility across security controls and technical assets,” said Nik Whitfield, CEO at Panaseer.

“Buying more tools does not equate to enhanced security. Ironically, in many cases they impair visibility and cause bigger headaches as they often integrate poorly, have overlapping functionality and gaps in coverage.”

To help overcome these visibility issues and satisfy requests for information from internal and external parties, security leaders are asking their staff to spend a lot time compiling manual reports across their large number of security tools. This has resulted in security teams spending more than a third of their time (36%) manually producing reports. 

When asked how they spend manual reporting time, the biggest task is formatting and presenting data (38.46%), followed by moving data (34.62%) across spreadsheets. The majority (70%) of security teams use manually compiled data for reporting to the board, while 57% claim they send manual reports to regulators and half (50%) said that they shared manually collated reports with auditors.

“Manual reporting creates a huge overhead for the business,” said Whitfield. “It also means that during a cyber skills shortage, we have specialist staff wasted doing very basic work. Manual reports are so prone to error, as they can only give a single snapshot in time and are then out of date almost immediately. Automation is an opportunity to enable greater speed, error reduction and crucially enhanced visibility.”