Ponemon Institute shows businesses’ effectiveness in preparing for and responding to cyberattacks have improved.
While organisations surveyed by the Ponemon Institute have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13 per cent during this same period.
The survey, sponsored by IBM Security, found that respondents’ security response efforts were hindered using too many security tools, as well as a lack of specific playbooks for common attack types.
While security response planning is slowly improving, most organisations surveyed (74 per cent) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all.
This lack of planning can impact the cost of security incidents, as companies that have incident response teams and extensively test their incident response plans spend an average of  US$1.2 million less on data breaches than those who have both of these cost-saving factors in place.
The key findings of those surveyed from the fifth annual Cyber Resilient Organisation Report include:
- Slowly Improving: More surveyed organisations have adopted formal, enterprise-wide security response plans over the past 5 years of the study; growing from 18 per cent of respondents in 2015, to 26 per cent in this year’s report (a 44 per cent improvement).
- Playbooks Needed:Even amongst those with a formal security response plan, only one third (representing 17 per cent of total respondents) had also developed specific playbooks for common attack types — and plans for emerging attack methods like ransomware lagged even further behind.
- Complexity Hinders Response:Â The amount of security tools that an organisation was using had a negative impact across multiple categories of the threat lifecycle amongst those surveyed. Organisations using 50+ security tools ranked themselves 8 per cent lower in their ability to detect, and 7 per cent lower in their ability to respond to an attack, than those respondents with less tools.
- Better Planning, Less Disruption: Companies with formal security response plans applied across the business were less likely to experience significant disruption as the result of a cyberattack. Over the past two years, only 39 per cent of these companies experienced a disruptive security incident, compared to 62 per cent of those with less formal or consistent plans.
The survey found that even amongst organisations with a formal cybersecurity incident response plan (CSIRP), only 33 per cent had playbooks in place for specific types of attacks. Since different breeds of attack require unique response techniques, having pre-defined playbooks provides organisations with consistent and repeatable action plans for the most common attacks they are likely to face.
The minority of responding organisations who do have attack-specific playbooks, the most common playbooks are for DDoS attacks (64 per cent) and malware (57 per cent). While these methods have historically been top issues for the enterprise, additional attack methods such as ransomware are on the rise. While ransomware attacks have spiked nearly 70 per cent in recent years, only 45 per cent of those in the survey using playbooks had designated plans for ransomware attacks.
Additionally, more than half (52 per cent) of those with security response plans said they have never reviewed or have no set time period for reviewing or testing those plans. With business operations changing rapidly due to an increasingly remote workforce, and new attack techniques constantly being introduced, this data suggests that surveyed businesses may be relying on outdated response plans which don’t reflect the current threat and business landscape.
The report also found that complexity is negatively impacting incident response capabilities. Those surveyed estimated their organisation was using more than 45 different security tools on average, and that each incident they responded to required coordination across around 19 tools on average. However, the study also found that an over-abundance of tools may actually hinder organisations ability to handle attacks. In the survey, those using more than 50 tools ranked themselves 8 per cent lower in their ability to detect an attack (5.83/10 vs. 6.66/10), and around 7 per cent lower when it comes to responding to an attack (5.95/10 vs. 6.72/10).
These findings suggest that adopting more tools didn’t necessarily improve security response efforts — in fact, it may have done the opposite. The use of open, interoperable platforms as well as automation technologies can help reduce the complexity of responding across disconnected tools. Amongst high-performing organisations in the report, 63 per cent said the use of interoperable tools helped them improve their response to cyberattacks.
This year’s report suggests that surveyed organisations who invested in formal planning were more successful in responding to incidents. Amongst respondents with a CSIRP applied consistently across the business, only 39 per cent experienced an incident that resulted in a significant disruption to the organization within the past two years compared to 62 per cent of those who didn’t have a formal plan in place.
Looking at specific reasons that these organisations cited for their ability to respond to attacks, security workforce skills were found to be a top factor. 61 per cent of those surveyed attributed hiring skilled employees as a top reason for becoming more resilient; amongst those who said their resiliency did not improve, 41 per cent cited the lack of skilled employees as the top reason.
Technology was another differentiator that helped organisations in the report become more cyber resilient, especially when it comes to tools that helped them resolve complexity. Looking at organisations with higher levels of cyber resilience, the top two factors cited for improving their level of cyber resilience were visibility into applications and data (57 per cent selecting) and automation tools (55 per cent selecting). Overall, the data suggests that surveyed organisations that were more mature in their response preparedness relied more heavily on technology innovations to become more resilient.
