On a range of cybersecurity indicators Australian businesses are falling behind global peers: lack of resources, skills, and staff mean security teams are struggling to respond
ServiceNow has released the local results of “Today’s State of Security Response: ‘Patch Work’ Demands Attention,” which reveals that Australian businesses are struggling to protect themselves from cyber threats. Over half of Australian respondents (52 per cent) have reported data breaches in the past year, the joint highest level with Netherlands, of all the countries investigated.
The survey of nearly 3,000 security professionals from nine countries around the world, including 220 from Australia, was carried out in association with the Ponemon Institute, which conducts independent research on privacy, data protection and information security policy. The study highlights the clear need for a new approach to respond to rising security threats.
The report reveals that despite the scale of the threats faced, Australian organisations are investing 82 per cent of their security resources on protection and detection functions, while neglecting the part of security that they can most control: their response.
This has proven costly: of the 52 per cent of companies that have suffered breaches, nearly half (48 per cent) acknowledged that they were breached because of a known vulnerability – a software security flaw for which a patch was already available.
Worryingly, more than a third of Australian companies (37 per cent) were actually aware that they were vulnerable before they were breached, highlighting the overwhelming need for an effective vulnerability response to close down attack paths before hackers strike. However, Australian security teams reported that they were not sufficiently staffed to patch resources in a timely manner, with 81 per cent feeling understaffed, the highest level in the world. In fact, Australia reported the second lowest levels of staffing for security globally, at 15 people on average, less than half the average number in the US (39 people).
“Organisations are focused on protecting themselves against the most sophisticated cyberattacks, yet they can dramatically improve their risk profile by focusing on the basics. Data breaches often occur because of a failure to patch vulnerabilities, yet the basic hygiene of patching is far from easy for most organisations,” said David Oakley, Managing Director, ServiceNow, ANZ.
“The single most impactful step businesses can take to improve their risk profile is to improve the patch management process. With the new Mandatory Data Breach Notifications Scheme now operational, this research shows the scale of the challenge that Australian businesses are facing. Patching is now a boardroom issue,” Oakley continued.
Barriers to timely patching of vulnerabilities
The survey investigated the characteristics of security leaders of organisations that have not been breached, and found that these leaders consistently rate their abilities higher in three key areas: detecting vulnerabilities, patching vulnerabilities in a timely manner, and detecting cyberattacks. Of these, timely patching was the most significant factor.
Australian organisations reported the second slowest levels of response times to patching high priority vulnerabilities, at 19.86 days on average. This was over two and a half days slower than the global standard of 17.26 days. This comes despite Australian organisations scanning for vulnerabilities at the second highest rate by frequency, every 8.54 days.
“Australian organisations report the second highest frequency of scanning for vulnerabilities, yet the second slowest time to patch high priority issues. It’s no coincidence that they also reported the highest levels, globally, of breaches occurring when the vulnerabilities were already known (37%). The scale of data breaches show that a new approach is needed,” said Oakley.
The research revealed that security teams struggle with timely patching because of manual processes and disconnected systems:
- 65 per cent in Australia (compared to 61 per cent globally) believe that the use of manual processes hinder their ability to respond to vulnerabilities;
- 65 per cent in Australia (compared to 62 per cent globally) also reported that delays in vulnerability patching were caused by a lack of ability to track whether issues were being patched;
- 68 per cent in Australia (compared to 65 per cent globally) said that they found it difficult to prioritise which issues should be patched first;
- 54 per cent both in Australia and globally feel that attackers are outpacing businesses with their use of technology such as machine learning and artificial intelligence.
“The research shows far too many teams are relying on manual processes to track issues. A staggering 68 per cent of Australian firms are using emails and spreadsheets to manage the patching process, so things slip between the cracks. This is 10 per cent higher than the global average, and underlines the need for security teams to upgrade their tools and tactics,” Oakley said.
Just hiring more people is neither effective nor practical
Australian organisations are planning to increase their headcount by nearly a third in the next twelve months (28 per cent), with the majority (64 per cent) saying they will hire staff specifically dedicated to patching. However, only 2.79 of these roles will be filled on average, the lowest number in the world of all the countries surveyed.
Yet the ability for organisations to hire their way out of vulnerability management shortfall is a high-risk strategy that is likely to fail. According to ISACA1, the global shortage of cybersecurity professionals will reach two million by 2019, and job site Indeed2 reports low interest in cybersecurity job postings. It is also unclear if additional staff will solve the fundamental structural issues with timely patching.
“With limited skilled staff available, AI and Machine Learning can help reduce the workload for security employees, and in Australia there’s significant room for improvement,” said Oakley. “Just 17 per cent are already using automated tools for protecting systems, while only 27 per cent are using the tools for the response. On both measures, Australia ranks the lowest of all the countries studied.”
These findings point to a lack of an integrated, end-to-end process that provides visibility and control across the entire vulnerability response lifecycle. Instead, by automating vulnerability investigation and breaking down data barriers, organisations can dramatically reduce breach rates while making the most of their existing staff.
Survey Methodology
ServiceNow commissioned the Ponemon Institute to survey nearly 3,000 IT security professionals. Respondents are based in Australia, France, Germany, Japan, the Netherlands, New Zealand, Singapore, the United Kingdom, and the United States, and represent organisations with more than 1,000 employees. The survey was administered online. Founded in 2002, the Ponemon Institute is a research centre specialising in privacy, data protection, and information security policy.
About ServiceNow
ServiceNow makes work better across the enterprise. Getting simple stuff done at work can be easy, and getting complex multi‑step tasks completed can be painless. Our applications automate, predict, digitise and optimise business processes and tasks, across IT, customer service, security operations and HR service delivery, creating a better experience for your employees and customers while transforming your enterprise. ServiceNow (NYSE: NOW) is how work gets done. For more information, visit: www.servicenow.com.
1The ‘2016 Cybersecurity Skills Gap’ infographic is created by the ISACA, a global non-profit IT advocacy group. ISACA. “2016 Cybersecurity Skills Gap.” https.cybersecurity.isaca.org, 1 Jan. 2016, image-store.slidesharecdn.com/be4eaf1a-eea6-4b97-b36e-b62dfc8dcbae-original.jpeg.
2‘Indeed Spotlight: The Global Cybersecurity Skills Gap’ research is based on data from July 1, 2014 to Oct 1, 2016 from 10 key markets with a significant number of cybersecurity job postings. “Indeed Spotlight: The Global Cybersecurity Skills Gap.” Indeed Blog, 27 Jan. 2017, blog.indeed.com/2017/01/17/cybersecurity-skills-gap-report/.
