Lack of visibility and complexity of managing data across both on-premise and cloud infrastructures are complicating the battle against cyber threats, according to a recent study by SANS Institute.
The SANS survey, titled “Effectively Addressing Advanced Threats,” noted that 74 percent of organisations have a blend of on-premise and cloud environments, in many cases using multiple cloud providers.
According to the findings, 48 percent of respondents said they lack visibility into what data and where data is being processed within the organisation. Access to sensitive data by insecure, unmanaged devices or individuals as well as a lack of geolocation information of the data were also identified as concerning blind spots.
When asked about the major barriers to detecting and remediating advanced threats, nearly half of the respondents emphasised an inability to understand or baseline normal user behaviour, with shortages in funding and resources coming in as a close second. Conversely, account or credential hijacking and privileged user abuse topped the list of major threats and risks realised within respondents’ environments.
The survey, which was sponsored by IBM Security, also looked at the challenges that respondents face within their cloud infrastructures and found that a lack of visibility remains at the core of their limitations.
When it comes to major gaps in the security analytics of their cloud-based infrastructure, the survey found that more than half of the respondents have concerns about integrating data with analytics tools and combining data across cloud environments.
It also noted that nearly 55 percent of organisations struggle with a lack of integration between current security analytics tools and cloud infrastructure.
SANS also underlined that approximately 43 percent face a lack of threat insights targeting cloud environments.
Endpoint alerts and network access devices are the top sources of incident information, providing alerts and investigation support, respectively.
“Clearly, visibility of data, users, devices and the cloud environment are playing a critical role in how and whether security professionals can fight advanced threats effectively,” said SANS instructor and survey author Matt Bromiley. “While many tools such as security analytics are available to the security community, implementing them is dependent on understanding the organisation’s environment.”
To learn more about how advanced threats are perceived and handled, and recommendations for better approaches, you can download the full report here.
