One Article Review
| Source |  AlienVault Blog |
|---|---|
| Identifiant | 858537 |
| Date de publication | 2018-10-23 13:00:00 (vue: 2018-10-23 16:00:41) |
| Titre | Why Spending More On Security Isn\'t The Answer |
| Texte |
Volume 8 of the AT&T Cyber Insights report looked into whether organizations who are investing more in cybersecurity are achieving better outcomes than those who aren’t.
The outcome of the research was a resounding no.
On the surface, this may seem counter-productive. After all, how many CISO’s have you ever heard complain about having too much security? However, if we look at the trend as an inverted U, or the law of diminishing returns, when you overdo something, you eventually stop seeing benefits, and may even see losses.
Getting the Porridge just Right
Much like Goldilocks, the question that arises is how much security is just right?
Former Director of the Enterprise Security Practice at 451 Research, Wendy Nather, wanted to establish The Real Cost of Security. In her research, security professionals provided a wide range of responses as to what security technologies are needed, with the majority of the respondents being able to trim down their list to around 10. The pricing of these 10 technologies varied greatly depending on a number of factors such as vendor, mode of deployment, whether it was open source, and so on - the price range varied anywhere from $225,000 to $1.46m in the first year, including technology and staff.
Expense in Depth
For many companies, especially those with small or mid-sized security teams, managing 10 or more individual security products can be challenging.
Former Forrester analyst Rick Holland coined the phrase ‘expense in depth’. That is where many companies will use the defense in depth concept to justify the need for more security products. The problem with this approach is that it can lead to buying too many technologies which don’t complement each other, which inevitably results in a multi-layered approach that provides minimal return on investment.
This leads us to a bit of an impasse. A variety of security controls are needed to provide adequate coverage. But too many security products lead to an increase in expense not just to procure, but to manage, which can lead to security shelfware.
More Capability in Fewer Products
In order to avoid some of these pitfalls, companies, especially ones with small to mid-sized security teams, should look to invest in fewer products that offer greater functionality.
The good news is that many security technologies have become standardised and no longer need to be acquired or deployed individually. For example, vulnerability scanning is largely a standardised function. While some scanners may perform better than others - by and large, you can point it to your assets and receive an expected output.
So, the question companies should ask, what benefits are being gained by running vulnerability scanning as a separate service with a standalone technology? Compare this to a platform which offers several security functions of which vulnerability scanning is one. The same could be said for anti-virus, or IDS, or SIEM’s. The value in running any of these as dedicated standalone services is diminishing.
Take the example of your smartphone. It has replaced many devices such as a pager, phone, camera, even a flashlight, into one device.
One could argue that a standalone dedicated camera, or flashlight is a superior product, which may be true, but it |
| Envoyé | Oui |
| Condensat | $225 “it’s ‘expense 000 451 46m able about achieving acquired addition additional adequate advantage after alert all also analyst answer anti any anywhere approach approached are aren’t argue arises around ask assets at&t avoid avp away batteries become being benefits best better bit boils bottom breach burning business businesses but buying camera can capabilities capability carrying challenging choosing ciso’s coal coined comes coming companies compare complain complement concept consequences considerations consistent consolidate controls cost could counter coverage critical crown cyber cybersecurity damaging dedicated defense depending deployed deployment depth depth’ device devices digital diminishing director disparate disruption documents doesn’t dollars don’t down each electricity end energy enough enterprise enterprises especially establish even event eventually ever example expected expense factors far farms fewer first flashlight focus focused former forrester from function functionality functions further gained generating getting goldilocks good greater greatly grind halt hand has have having heard helping her holland home house how however ids impact impasse importance incident including increase individual individually inevitably infrastructure insights insist insurance inverted invest investigation investing investment isn it’s jewels just justify know large largely law layered lead leads leak leg like line list logs longer look looked losses majority manage managed management managing many may maybe mean means mid minimal mode monitor monitoring more mssp much multi nather need needed news non not number offer offers offload offshore one ones open option order organisation organizations other others outcome outcomes output outsource overdo overhead pager partners perform perhaps perspective phone phrase pitfalls place plan platform point porridge practice price pricing problem process procure product productive products professionals program protecting provide provided provider providers provides question range ransomware reaching real receive reducing relationships rely replaced report research resounding respondents responses result results return returns rick right risk risks running said same scanners scanning security see seeing seem sensitive separate service services several shelfware should siem’s sized small smaller smartphone solar solely solutions some something sometimes source spending spends staff stale standalone standardised stool stop strategy: such superior supply surface take takes tasks team teams teams’ technologies technology than them these think third those todd too tools transferring trend trim true ultimately use using value varied variety vendor virus volume vulnerability wanted wanting warrants waskelis wendy what when where whether which who why wide will wind within year your |
| Tags | Ransomware Vulnerability Guideline |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.