November 17, 2011 – Enterprises are under attack, but unprepared for the type of cyber attack known as an advanced persistent threats, and addressing security is creating massive amounts of data to deal with manually, according to a report from Enterprise Strategy Group.

For its new report, “U.S. Advanced Persistent Threat Analysis: Awareness, Response and Readiness Among Enterprise Organizations,” ESG questioned 244 U.S.-based security officials at businesses consisting of 1,000 employees or more on their APT preparedness and responses. 

Seventy-nine percent of organizations surveyed are lacking the essential security knowledge and technological defenses for protection against APTs, though awareness of the threat is increasing. Another 77 percent are dedicating hardware, software and training on APTs, according to ESG. 

Executive management prompted action on APTs and interaction with their security teams on the threat in 47 percent of cases, though an equal amount from the business-side have taken no action in response to APTs, the report indicated. Jon Oltsik, senior principal analyst with ESG and report lead author, says that IT and especially the business-side can not dismiss these growing risks when compiling their strategies and budgets.

“To take advantage of more data, analytics and social media, C-level executives need to understand that security has to be integrated into technology and business processes from the start. Think of security as a cost of doing electronic business these days,” Oltsik says. 

Oltsik notes that dealing with security data is also creating issues with massive amounts of daily information and the widening gap of talent to handle this specific type of information. Sixty-eight percent of those surveyed reported that security data is most often collected through an assortment of networking management tools, including event and log data solutions that compile terabytes of data on a daily basis. Automated data filtering with this can be difficult, resulting in a strong reliance on manual skills to deal with this data. ESG noted a “pressing need” for research and development of automated security analytics tools for scale, and Oltsik says current systems are “making security data analytics and forensics a big data problem.”

Survey respondents were divided on the federal government’s role in curbing APTs. Seventeen percent stated that the federal government isn’t doing enough, and 35 percent found the government’s role as “sufficient.” Top enterprise suggestions to Washington included improving public/private data sharing, creating an APT taskforce, and enacting stricter cybersecurity legislation. 

Register or login for access to this item and much more

All Information Management content is archived after seven days.

Community members receive:
  • All recent and archived articles
  • Conference offers and updates
  • A full menu of enewsletter options
  • Web seminars, white papers, ebooks

Don't have an account? Register for Free Unlimited Access