So Many Breaches, So Few Insights

When it comes to malicious activity on their network, information security executives have more information than ever, but that doesn’t mean they know what to do with it.

The numbers on incidents, downtime and damages have remained steady, but some other numbers in this year’s breach data are unsettling. First, the sharply rising number of respondents who report damages as “unknown,” up to 47 percent this year from 40 percent two years ago, suggests that respondents have neither the time nor the means to truly calculate losses from a breach, or if they considered the attacks minor, they didn’t bother. The increased sophistication of attacks during the past year could also contribute to the rising “unknown” group.

The more complex attacks hit more complex targets. Take the hypothetical identity theft of 1,000 customer records. Many experts are concerned about “deferred loss identity theft,” wherein thieves sit on stolen identities for months or years until victims believe the danger has passed. It’s hard to put figures on potential outcomes like that.

Other “unknown” responses get one’s attention too: “Unknown” showed up in survey responses as the second most prevalent attack type, the fourth most common attack method and the third highest attack source. Plus, data or material damages trail only firewall and IDS logs as the means of discovering attacks. In other words, information security professionals most often react. They learn of attacks after the damage is done. And often once the events happened, they couldn’t figure out what it was, where it came from or who did it.

CIOs, CISOs and CSOs have gotten quite good at collecting and logging events on their networks—organizing their haystacks—but haven’t been able to reliably turn all that data into intelligence—efficiently finding the needles before they are pricked by them. A long-term strategic goal of all information security departments should be to reorganize so that they work as an intelligence unit rather than just a data collection unit.

Follow the Money...Please!

Information security is getting more money, but exactly how much and from where isn’t always clear.

It’s more evidence of a lack of strategic direction.

in previous years when we asked what your information security budget was, we didn’t include “don’t know” as an option. This year, we did, and Bang! A full one-fifth (22 percent) of the information executives responding said they didn’t know how much money their companies budget for infosecurity. More signs of a lack of proactive, strategic focus. Not good.