Why IT Is Failing At Security Hygiene: Survey

Jennifer Ellard Posted on 04.06.17 — by Jennifer Ellard

IT leaders have a problem with perception versus reality when it comes to understanding what’s happening with their endpoints, according to a recent Frost and Sullivan survey commissioned by Tanium. Here’s what we found out about security hygiene practices, and what you can do about it.

While nearly everyone agrees security hygiene is essential to keeping organizations safe from cyber attackers, the way forward is less clear. A recent Frost & Sullivan report, based on a survey of 200 North America-based IT decision makers commissioned by Tanium, reveals a sharp disconnect between IT priorities and existing security hygiene practices.

For example, while the vast majority of respondents (94%) say they are extremely or moderately confident that they know how many endpoints exist in their organizations, more than one third acknowledge the likelihood of unaccounted endpoints.

Knowing how many endpoints you have — and what is happening on them at any point in time — is a cornerstone of security hygiene best practices. After all, hackers only need to locate and compromise a single endpoint to gain access to your network. You know this in theory, yet the survey results indicate real-world practices have a long way to go.

Indeed, 70% of respondents identified reducing the frequency and severity of data breaches involving personally identifiable information (PII) as a “critical” or “high” priority for their organizations. Streamlining regulatory compliance and maintaining business continuity are also top priorities for a majority of respondents.

Yet, less than a third of respondents (32%) are confident that, when a breach happens, they’ll be able to identify all affected endpoints and remediate within one day of a breach. Not a shocking finding, but less than half of respondents are confident their current anti-virus solution is keeping them safe.

security hygiene: How confident is IT in its ability to always have an exact count of every endpoint

Patching software for critical security issues is seen as a cyber hygiene best practice. Yet, here, too, there’s a disconnect between what respondents believe in theory and what they’re experiencing in practice. Nearly eight in 10 respondents (79%) say they’re “extremely” or “moderately” concerned that critical OS security patches are missing from their endpoints. Reasons vary, including factors such as application incompatibility, a lack of systematic means to install critical patches across all endpoints, and a lack of available IT resources to oversee patching. Products currently exist to address a both the latter points.

security hygiene: Why are critical OS security patches not being installed?

More Operating Systems, More Security Hygiene Problems

Why is this so alarming? For one thing, operating system diversity is on the rise for enterprise PCs and servers alike.

The majority of respondents report having six OSes on their PCs and as many as seven OSes running on their servers. While respondents say the newest releases of Windows OS on PCs and servers are up-to-date, the same is not true when it comes to Mac-based PCs, Linux servers, and older versions of Windows Server still in use.

security hygiene: How many operating systems are running on your enterprise endpoints?

 

security hygiene: How many operating systems are running on your enterprise servers?In addition to concerns about currency in OS release version and security patches, the majority of the survey participants also express extreme or moderate levels of security concern regarding high-use applications such as Java, Flash, and Acrobat.

Endpoint Scanning: Key To Security Hygiene Best Practices

Even more troubling, the majority of respondents say more than half of all endpoints are not scanned, or are only scanned periodically, for security configurations, software vulnerabilities, and file integrity. More than two thirds of respondents (68%) classify their current scanning practices for servers as ineffective, while 42% say the same about their PC scanning practices.

security hygiene: where endpoint scanning fails

IT security organizations need to take steps to improve the basics of security hygiene. Frost & Sullivan advises organizations to objectively rate their current security hygiene tools based on what they accomplish and what they do not accomplish. This rating will produce a priority list of the attributes to seek in new or replacement security hygiene tools and what these tools should accomplish.

Click here to download the full report, which includes recommendations from Frost and Sullivan on how to improve your security hygiene practices to keep your organization safe and secure.

Want to learn more about security hygiene? Read these:

Like what you see? Click here and sign up to receive the latest Tanium news and learn about our upcoming events.