Enterprises Lack Threat Data For Security Budgets

The majority of enterprises seeking to develop their security strategy for 2013 are highly reliant on the annual threat reports compiled by security and Internet-service firms.

So says a new survey conducted by security-services firm Solutionary, which found that nearly seven out of every eight companies use the global threat reports created by firms such as McAfee, Microsoft, Symantec and Verizon to guide their security strategies.

Budget Justification

Almost 80 percent of the security professionals who responded to the survey use annual threat data to support their requests for budget increases.

By creating reports that are more useful for their customers, security software specialists and service providers can benefit by helping their customers’ security teams successfully argue for budget hikes, said Rob Kraus, director of research for the Solutionary Engineering Research Team.

“Through the history of security, we have always had that challenge of how do I justify this, how do I get the money, how do we tell our bosses that it is important, how do I let our C-level executives know that we need to do this to address a lot of threats out there that could cost us a lot of money,” he said. “Organisations are still having difficulty overcoming and obtaining budget.”

Solutionary conducted the survey to guide the creation of its own global threat intelligence report, gathering feedback on what its customers would like to see in their report. Nearly 180 companies responded to the questionnaire, but not all companies answered every question. There were a number of surprises, Kraus said.

Nearly nine out of 10 companies that do not currently use global threat reports in their security process would use the documents if there were more guidance on how to garner more budget for their security teams, Kraus said. The most important topic is how to conduct self-assessments and show companies’ current weaknesses, according to more than 40 percent of surveyed companies.

“The security professionals we have out there are fighting the fight and doing a good job, but maybe they don’t have the culture of security built into their environment so much that they actually need more guidance on how to secure that funding,” Kraus said. “That’s a staggering number.”

BYOD Threat

In the past, compliance has driven budgets for security, but increasingly companies are looking to improve their security posture, not just follow the letter of compliance regulations, he said. For example, this year a growing number of organisations asked Solutionary for help analysing malware, an activity not required by compliance regulations.

The most useful part of threat reports is the executive summaries, according to a fifth of the companies surveyed. Kraus argues that these shortened versions of reports are sent to executives to help make arguments for more money. About one-sixth of companies identified statistics on global threats as the most important information, and slightly less than that sought out specifics on identified threats.

The biggest threat on the radar for 2013 is the bring your own device (BYOD) trend, said Kraus. While companies gain productivity and lower costs when employees use their own information devices, they lack the security controls typically enforced on internal devices. In addition, distributed denial-of-service attacks are increasingly being used to mask other aspects of an attack.

“The culture of security needs to be ingrained in your organization, and it is not going to happen overnight,” Kraus said. “Security is a team sport, and we all need to know that we need to overcome the obstacles in regards to funding.”

Are you a security pro? Try our quiz!

Robert Lemos

Robert Lemos covers cyber security for TechWeekEurope and eWeek

View Comments

  • The individual assessment of security threats for each company has to be the most important thing as Kraus says. Companies shouldn't rely solely on threat reports as the CFOs need more specific information or they won't take it seriously after long - they need specifics. There are many aspects to consider ( ) and the process will be difficult at first but the added credibility it will gain the CIO will be invaluable in the long run.

Recent Posts

Signal Shows Data Collection Adverts Facebook Rejected

Signal has had user-targetted adverts on Instagram blocked, as messaging service attempts to highlight Facebook…

5 hours ago

Oversight Board Upholds Trump’s Facebook Suspension

Bad news for Donald. Facebook's 'Supreme Court' upholds suspension of Donald Trump account, but asks…

6 hours ago

US Presses TSMC For More Chips For Car Makers

Global silicon shortage continues, as US Commerce Department presses Taiwanese chipmakers to ease the supply…

7 hours ago

Starlink Signs Up 500,000 Pre-Orders For Satellite Internet

Elon Musk space venture SpaceX has already signed 500,000 customers on pre-order for its Starlink…

9 hours ago

Apple Vs Epic Games Court Battle Continues

Second day of courtroom showdown in the US reveals Epic Games management would have accepted…

11 hours ago

Trump Launches ‘Communications’ Website

Banned from social media for instigating US Capitol riot, Trump launches 'straight from the desk'…

13 hours ago