The report is based on an Osterman Research survey of 126 security professionals who have knowledge about or responsibility for security testing within their organizations. Security testing is the process of testing databases, networks and applications for vulnerabilities that could allow bad actors to penetrate them and steal sensitive or confidential information, encrypt data, disable intended functionality, or otherwise cause harm. The survey was sponsored by and conducted on behalf of cybersecurity and managed security services provider Trustwave.
Key findings from the “Security Testing Practices and Priorities: An Osterman Research Survey Report” include:
· Most organizations are not proactive about security testing—Fewer than one in four organizations considers themselves to be “very proactive” in the context of security testing, while nearly one-half are “somewhat proactive.” However, nearly one-third of organizations consider themselves “somewhat” to “very” reactive about security testing, or that their security testing posture is “non-existent.”
· Many organizations do no security testing—One in five organizations has not conducted security testing of any kind during the past six months. Among those that do conduct security testing, 66 percent do so only monthly or less frequently, and most do not perform regular security testing after every infrastructure change. Most organizations conduct security testing using a combination of in-house resources and third-party testing services, although two in five organizations manage security testing only in-house.
· Most organizations find security testing a valuable best practice—Despite the fact that many organizations do not perform security testing, two-thirds believe that security testing is a valuable best practice.
· Security testing and reviews are infrequent and, in some cases, organizations are leaving it up to fate—Both security testing and reviews of these tests are not commonplace: only 5 percent perform detailed reviews of security testing to assess vulnerabilities on a daily basis and only 24 percent do so weekly or multiple times during the week. Meanwhile, 25 percent of the organizations surveyed perform these reviews only quarterly or annually, and 20 percent do so only when they perceive the need, creating a situation where businesses are simply guessing when to test their systems.
· Security skills shortage and testing challenges abound—Among the leading security testing challenges discovered in the survey, the most commonly cited are insufficient staffing, insufficient time with which to perform the security tests, and insufficient skills to support regular testing.
· More than half of organizations are turning to third parties for help with security testing—To address these issues, a large proportion of those surveyed are open to the idea of using third parties, like managed security services providers, to perform security testing on their behalf. Thirty-five percent of those surveyed already do partner with a third-party for security testing, and another 21 percent plan to do so during the next year. Only 9 percent of those surveyed don’t plan to use third-party security testing services.
· No one is immune to cyber attacks—95 percent of survey respondents reported encountering one of the dozen common security issues associated with security vulnerabilities that were listed in the survey.
“Emerging trends like shadow IT, mobility and Internet of Things make regular security testing more important than ever,” said Kevin Overcash, Director of SpiderLabs at Trustwave. “This includes both automated security scanning, which will help uncover potential vulnerabilities and weak configurations, and in-depth penetration testing, which is designed to exploit vulnerabilities just like criminals would in the real world.”
“This report should be a major wake-up call for businesses and government agencies that a new approach and strategy for security vulnerability testing is required to better fortify databases, networks and applications against data theft and breaches,” said Michael Osterman of Osterman Research. “Organizations need to look at security testing more comprehensively and perform it more frequently. Increasingly, security-savvy organizations are turning to managed security services providers for help in this area.”
