New Insight From Cyber adAPT And Aberdeen Group Reveals Faster Cyber Attack Detection Can Limit Business Impact By 70%

Detection, response and recovery time revealed to be critical for edgeless networks

July 11, 2017 – Half Moon Bay, California – A new report released today, commissioned by Cyber adAPT and conducted by Aberdeen Group, has revealed that cyber attack detection and response times have a critical status in protecting access to infrastructure and data within modern networks.

New insight detailed in the report entitled ‘The need for speed: faster detection requires a new type of platform’, reveals that doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.

The report also shows that improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.

Monte Carlo analysis: Reducing the Business Impact of Disruptions and Data Breaches

Source: Monte Carlo analysis; Aberdeen Group June 2017

The findings help contextualize the current cyber security climate, which McKinsey and the World Economic Forum has previously described as one where 60% of technology executives agree the sophistication as well as the pace of attacks will increase faster than the ability of institutions to defend themselves[i].

The report also consolidates existing research from Aberdeen Group, which found:

• Two out of five (39%) organizations are moving from a traditional, PC-oriented computing environment toward an increasingly mobile-first infrastructure, and half (49%) of all respondents have already invested in connected devices (IoT) initiatives[ii].
• In a study of 3,000 current network firewall installations nearly half (46%) of all organizations were dealing with multiple sites and/or multiple firewall vendors[iii].
• In an analysis of nearly 11,000 security monitoring and analytics installations, two-thirds of CISOs are taking a tools-based approach to cyber security, installing a single product at a single site. The remaining third of installations typified a platform approach[iv].
• In current technology installations of virtualization and cloud computing initiatives involving 336 products from 57 vendors, there were more than 1.6 billion permutations in the simple six-layer stack[v].

The report describes a dynamic infrastructure, which includes a mix of traditional servers, private clouds, and public clouds as “the new normal”, and notes that its complexity means that using prevention-led methods cannot be successful 100% of the time.

Kirsten Bay, President and CEO of Cyber adAPT commented on the new insights and wider report: “Criminals are gaining access to our networks regardless of how much money has been sent on perimeter defenses. The unique, new insights released today demonstrate the pressing need for CISOs to be able to quickly detect these inevitable breaches and act upon them immediately, if they are to limit the impact.[vi]”

Bay continues:

“Furthermore, the report identifies that today’s enterprise computing infrastructure is increasingly digital, edgeless and hybrid. With a vast number of firewall installations and other security tools to manage, the data demonstrates that a strategy focused on prevention alone is no longer enough – detecting anomalies and defending this blurred perimeter is simply beyond human capability.”

Derek Brink, Vice President and Research Fellow, Aberdeen Group and author of the report commented: “Our report shows that in securing increasingly complex computing infrastructures CISOs have a bastion of tools at their disposal. But this has only served to deliver an onslaught of alerts, which take time to filter. To regain their time advantage against attackers, CISOs need a single platform, which integrates data from multiple sources and offers optimized visibility into a rapidly changing threat landscape. This will allow them to detect threats in real-time and respond before attackers compromise information and remove access to vital infrastructure.”

Key insights:

• When it comes to detection, response and recovery time are crucial.
• CISOs need to make the business case for how faster detection, effective response, and rapid recovery reduces the impact of attacks.
• Doubling detection and response speed to cyber attacks produces a median reduction of 70%, compared to the status quo*, in impact on the availability of enterprise computing infrastructure.
• Improvements to detection and response speed following a data breach produces a median reduction of 30% in impact on the business, compared to the status quo*.
• Today’s enterprise computing infrastructure is a dynamic blend of traditional networks, expanding user bases, a mix of private and public clouds, and connected devices.
• In such an environment, timely detection of active attacks – at the scale and speed needed – requires a new type of platform.

[i] The rising strategic risks of cyberattacks, McKinsey and the World Economic Forum, May 2014

[ii] Aberdeen Group Survey, 2017

[iii] Firewall Sprawl: How Complexity is Adding Cost and Increasing Risk, Aberdeen Group, 2015

[iv] The Business Value of a Security Monitoring and Analytics Platform, Aberdeen Group, 2016

[iv] Security Operations in Public Cloud Services: Going With Your Strengths, Aberdeen Group, 2016.

[v] The Need for Speed: Faster Detection Requires a New Type of Platform, research commissioned by Cyber adAPT and conducted by Derek Brink, Aberdeen Group, 2017

*The status quo for dwell times is based on the empirical data from investigations of confirmed data breaches by Verizon and its partners, between 2014-2016.