{"id":18191,"date":"2018-04-20T14:49:31","date_gmt":"2018-04-20T13:49:31","guid":{"rendered":"http:\/\/www.intelligentcio.com\/africa\/?p=18191"},"modified":"2018-04-20T14:49:31","modified_gmt":"2018-04-20T13:49:31","slug":"servicenow-research-uncovers-securitys-patching-paradox","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/africa\/2018\/04\/20\/servicenow-research-uncovers-securitys-patching-paradox\/","title":{"rendered":"ServiceNow research uncovers security\u2019s patching paradox"},"content":{"rendered":"<p><em>ServiceNow Inc has <\/em>released new research,\u00a0<em>Today\u2019s State of Vulnerability Response: Patch Work Demands Attention<\/em> based on a survey conducted with the Ponemon Institute. The report uncovered security\u2019s \u2018patching paradox\u2019 \u2013 hiring more people does not equal better security. While security teams plan to hire more staffing resources for vulnerability response they won\u2019t improve their security posture if they don\u2019t fix broken patching processes.<\/p>\n<p>Firms struggle with patching because they use manual processes and can\u2019t prioritise what needs to be patched first. The study found that efficient vulnerability response processes are critical because timely patching is the most successful tactic companies employed in avoiding security breaches.<\/p>\n<p>ServiceNow surveyed nearly 3,000 security professionals to understand the effectiveness of their vulnerability response tools and processes.<\/p>\n<p>\u201cAdding more talent alone won\u2019t address the core issue plaguing today\u2019s security teams,\u201d said Philip van der Wilt, General Manager and Vice President Sales EMEA, ServiceNow.<\/p>\n<p>\u201cAutomating routine processes and prioritising vulnerabilities will help organisations avoid the \u2018patching paradox,\u2019 instead focusing their people on critical work to dramatically reduce the likelihood of a breach.\u201d<\/p>\n<p><strong>Firms plan to invest in additional staff for vulnerability response <\/strong><\/p>\n<p>Cybersecurity teams already dedicate a significant proportion of their resources to patching.<\/p>\n<ul>\n<li>EMEA organisations spend 319 hours a week on average \u2013 the equivalent of about eight full-time employees \u2013 managing the vulnerability response process<\/li>\n<li>63% of EMEA respondents say they plan to hire more dedicated resources for patching over the next 12 months<\/li>\n<li>On average, the EMEA respondents surveyed plan to hire about 3.8 people dedicated to vulnerability response \u2013 an increase of 48% over today\u2019s staffing levels<\/li>\n<\/ul>\n<p><strong>Hiring won\u2019t solve the problem: Tteams struggle with broken processes<\/strong><\/p>\n<p>According to <a href=\"https:\/\/wpyadmin.ne.cision.com\/l\/afzobgrz\/image-store.slidesharecdn.com\/be4eaf1a-eea6-4b97-b36e-b62dfc8dcbae-original.jpeg\">ISACA<\/a>, a global non-profit IT advocacy group, the global shortage of cybersecurity professionals will reach two million by 2019. The study found that hiring won\u2019t solve the vulnerability response challenges facing EMEA organisations, with the results of the respondents based in EMEA revealing that:<\/p>\n<ul>\n<li>53% say that they spend more time navigating manual processes than responding to vulnerabilities<\/li>\n<\/ul>\n<ul>\n<li>EMEA security teams lost an average of 11.5 days manually coordinating patching activities across teams<\/li>\n<li>65% say they find it difficult to prioritise what needs to be patched first<\/li>\n<li>62% say that manual processes put them at a disadvantage when patching vulnerabilities<\/li>\n<\/ul>\n<ul>\n<li>\u00a056% say that hackers are outpacing organisations with technologies such as machine learning and artificial intelligence<\/li>\n<li>\u00a0Cyberattack volume increased by 16% last year and severity increased by 22%<\/li>\n<\/ul>\n<p>\u201cMost data breaches occur because of a failure to patch, yet many organisations struggle with the basic hygiene of patching,\u201d van der Wilt said.<\/p>\n<p>\u201cAttackers are armed with the most innovative technologies, and security teams will remain at a disadvantage if they don\u2019t change their approach.\u201d<\/p>\n<p><strong>Quickly detecting and patching vulnerabilities significantly reduces breach risk \u00a0<\/strong><\/p>\n<p>Organisations that were breached struggle with vulnerability response processes compared with those organisations that weren\u2019t breached:<\/p>\n<ul>\n<li>48% of EMEA organisations have experienced a data breach in the last two years, compared to 48% globally<\/li>\n<li>A majority of EMEA breach victims (54%) said that they were breached because of a vulnerability, for which a patch was already available<\/li>\n<li>A total of 32% of EMEA security professionals were aware that they were vulnerable before they were breached<\/li>\n<li>EMEA organisations that avoided breaches rated themselves 29% higher on the ability to patch quickly (compared to 41% globally) than organisations that had been breached<\/li>\n<li>40% of breach victims said they don\u2019t scan for vulnerabilities<\/li>\n<\/ul>\n<p>\u201cIf you\u2019re at sea taking on water, extra hands are helpful to bail,\u201d van der Wilt said.<\/p>\n<p>\u201cThe study shows most organisations are looking for bailers and buckets instead of identifying the size and severity of the leak.\u201d<\/p>\n<p><strong>Broken processes can be overcome<\/strong><\/p>\n<p>Here are five key recommendations that provide organisations with a pragmatic roadmap to improve security posture:<\/p>\n<ul>\n<li>Take an unbiased inventory of vulnerability response capabilities<\/li>\n<li>Accelerate time-to-benefit by tackling low-hanging fruit first<\/li>\n<li>Regain time lost coordinating by breaking down data barriers between security and IT<\/li>\n<li>Define and optimise end-to-end vulnerability response processes, and then automate as much as you can<\/li>\n<li>Retain talent by focusing on culture and environment<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>ServiceNow Inc has released new research,\u00a0Today\u2019s State of Vulnerability Response: Patch Work Demands Attention based on a survey conducted with the Ponemon Institute. The report uncovered security\u2019s \u2018patching paradox\u2019 \u2013 hiring more people does not equal better security. While security teams plan to hire more staffing resources for vulnerability response they won\u2019t improve their security [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":18192,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,6,36,13],"tags":[5046,285,774],"class_list":["post-18191","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-intelligent-technology","category-top-stories","tag-philip-van-der-wilt","tag-ponemon-institute","tag-servicenow"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/18191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=18191"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/18191\/revisions"}],"predecessor-version":[{"id":18193,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/18191\/revisions\/18193"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/18192"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=18191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=18191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=18191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}