The recently released 2018 Security Pressures Report from Trustwave highlighted the diverse points of pain facing security professionals. In case you were wondering, there is more than enough torment to go around.
But the report, now in its fifth year, zeroed in on some bright spots where infosec practitioners are making progress - two in particular, which should help you stay upbeat amid these tumultuous times.
The pressure to rush IT projects before they are security ready is decreasing. The bulk of 1,600 leaders and decision makers polled in the 2018 Security Pressures Report revealed that their organization still emphasizes speed to market over security (58 percent) when it comes to the completion of IT projects. But the divide continues to shrink, as that number has plummeted 20 percentage points over the last five years.
The steep decline is apparent proof that businesses are applying more diligence into their software design process to help ensure vulnerabilities are kept to minimum once the project is placed into production.
This is a hopeful sign that the message of security is proliferating companywide. As a result, management may be easing development deadlines so that operational requirements, including security testing, can comfortably fit into the scope of these projects. As well, the improving numbers point toward better security understanding and appreciation among development teams and enhanced support and enablement from their peers from the IT and security department.
In general, there appears greater recognition that the earlier in the lifecycle that security is integrated, the cost is far less than if it is added at the end. Baked in is cheaper than bolted on.
Generally speaking, a system, device or application with fewer functions is more secure than one with many functions because it contains less code that can be exploited by unauthenticated users, in the process creating a smaller attack surface. Put another way, less is sometimes more.
The same logic applies to security solutions - but in a different kind of way.
As we've lamented many times in this space, organizations often lack the appropriate in-house skills and other resources, such as time and headcount, to address the sheer number of threats they must face. If they are unable to correctly operate a feature-filled security product, it may end up just collecting dust - especially if it was only purchased to satisfy a compliance auditor. SIEM is notorious for going underused.
Even large companies that make considerable investment in security will struggle in the face of advanced threats if they are replete of the appropriate talent needed to adopt and deploy security technologies.
Which brings us back to the Security Pressures Report: Only 56 percent of responÂdents (down eight percentage points from last year's report and a whopÂping 18 percentage points from two years ago) reported feeling pressure to select and purchase security technologies containing all the latest features. However, for those 56 percent of respondents still feeling coercion to adopt and deploy the security technology de rigueur, 31 percent do not believe they have the adequate resources to get them up and running.
A legitimate alternative is to turn to a managed security services provider whose technical savvy should not only help you properly assess and configure your security products for optimal performance, but also help you detect and respond to threats - in some cases by having access to its own security operations centers, which are staffed around the clock with experts who have in-depth knowledge and experience working with complex network environments for highly distributed environments.
***
Obviously if you're doing neither of these things - 1) advocating for software designers and better security during the development lifecycle and 2) opting for skills over any additional "feature creep" within your network - you should start as soon as possible, if for no other reason than to share in the good news that smarter security is winnable.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.