Survey: Does Your Cybersecurity Have Defense in Depth?

CISOs agree: The right technologies and defense in depth are the key factors in avoiding major cybersecurity breaches. It helps to have good processes and a skilled staff in place, but strong cybersecurity technologies are the most important factor to avoid data breaches. 

Don’t just take it from me – a large majority of respondents in a recent Forrester Consulting survey, commissioned by Fortinet, said better security technology was integral to their security successes. 

The survey asked 342 CISOs and other security executives about their biggest security challenges. Topping the list was the rapidly evolving nature of cyberthreats, followed by security in the cloud, the complexity of their IT environments, and securing IoT. Not too surprisingly, more than two-thirds of the respondents reported that their organizations have been breached at some point. Those organizations breached in the last two years have been compromised an average of three times. 

More than 7 in 10 of respondents who have not experienced a data breach cited better security technologies as key to their success, while more than half of those who have had breaches pointed to the same factor. 

Just over half of each group pointed to better security procedures and processes as an important part of their cybersecurity programs, while about 30 percent pointed to more staff. 

The findings highlight the importance of layered security, sometimes called ‘defense in depth’. Organizations that deploy 10 or more security technologies experienced few breaches, respondents reported. 

Among the most popular cybersecurity technologies: threat intelligence, virtualization-aware security, network analysis and visibility, endpoint detection and response, network access control, SIEM, and endpoint prevention technologies. All those technologies were used by at least 70 percent of the respondents who said they haven’t had a breach. 

Beyond security technologies, outsourcing appears to be a major factor in keeping organizations safe. Those not experiencing a breach were 33 percent more likely to outsource some security functions to one or more vendors than those who have experienced a breach. 

So What Action Items Should CISOs Consider?  

Organizations should build sustainable security programs led with the right technology. Companies that have avoided breaches use multiple security technologies, embrace threat intelligence-gathering services, and use support from a wide range of sources to acquire security technologies. 

The Forrester report recommends that organizations focus their people and processes on supporting a “technology-led security practice.” That includes security leaders becoming more embedded with line-of-business teams and finding the right security partners, including outsourced providers. 

Organizations should also explore security automation, Forrester recommended. “Manual processes place a higher burden on security staff to recognize and respond to threats, while automation can bring efficiencies,” Forrester’s report says. 

Finally, CISOs and other security executives should stay up-to-date with security technologies and threats. Attend conferences, talk to your peers, and work with vendors to understand new threat intelligence technologies and methods, including Fortinet’s recently announced cloud-based FortiGuard Threat Intelligence Service (TIS) designed to provide CISOs with a high-level view of the global threat landscape with insight into threat activity trends currently impacting their industry. FortiGuard TIS delivers strategic threat intelligence to ensure that CISOs have greater cyber situational awareness to apply the right security strategy and investments. 

CISO’s Role in Securing the Business 

CISOs must continually assess their security strategies and adjust when it’s needed. Tools such as FortiGuard TIS help them identify their potential security gaps to best determine plans to fix them and to measure improvements. 

The role of today’s CISO is rapidly evolving. CISOs need to become business managers focused on protecting their brands, strengthening their reputations, and building customer trust. They should build better connections with leaders within their own organizations, and they should look for ways security can fit into existing business process. Security must become “an asset – not a hindrance,” Forrester says.