Despite the doubling of data breaches in the banking, credit and financial sectors between 2014 and 2015, most IT professionals in financial services are overconfident in their abilities to detect and remediate data breaches. According to a new study by endpoint detection, security and compliance company Tripwire, 60% of these professionals either did not know or had only a general idea of how long it would take to isolate or remove an unauthorized device from the organization’s networks, but 87% said they could do so within minutes or hours.
When it comes to detecting suspicious and risky activity, confidence routinely exceeded capability. While 92% believe vulnerability scanning systems would generate an alert within minutes or hours if an unauthorized device was discovered on their network, for example, 77% said they automatically discover 80% or less of the devices on their networks. Three out of 10 do not detect all attempts to gain unauthorized access to files or network-accessible file shares. When it comes to patching vulnerabilities, 40% said that less than 80% of patches are successfully fixed in a typical cycle.
The confidence but lack of comprehension may reflect that many of the protections in place are motivated by compliance more than security, Tripwire asserts.
“Compliance and security are not the same thing,” said Tim Erlin, director of IT security and risk strategy for Tripwire.
“While many of these best practices are mandated by compliance standards, they are often implemented in a ‘check-the-box’ fashion.
Addressing compliance alone may keep the auditor at bay, but it can also leave gaps that can allow criminals to gain a foothold in an organization.”
Check out more of the study’s findings below:
Similar Posts:
- Financial Services Firms Report Losing 27% of Revenue Due to Poor Reputation
- Only 18% of IT Pros Confident in Current Password Risk Management
- Staying Ahead of the Financial Industry’s Next Wakeup Call
- Cyberbreach and Reputation Woes Hack Away at Bottom Line for 44% of Financial Firms
- Strength in Numbers: Internet Risk Detection and Brand Protection