New RSA Security Brief Provides Roadmap for Next Generation Security Operations

AMSTERDAM, Oct. 29, 2013 /PRNewswire/ -- RSA CONFERENCE EUROPE 2013

News Summary:

• Expert consultants and security leaders from EMC, Raytheon and RSA assert that organizations large and small are recognizing they have a responsibility to improve their security posture not just for themselves but also for business and supply chain partners.
• Security consultants report more organizations are commissioning security assessments on a proactive basis, not just following a breach.
• RSA Security Brief highlights that basic security lapses still contribute to most security incidents.
• New report identifies top areas for improvement and provides practical guidance on measures that deliver the greatest impact on organizations' ability to respond to cyber attacks and data breaches.

Full Story:

Authors of a new Security Brief released today by RSA, The Security Division of EMC (NYSE:EMC), titled "Taking Charge of Security in a Hyperconnected World" observe that more organizations are proactively improving their readiness for cyber threats. While concerns arise about the escalating threat environment, the report asserts that efforts to improve readiness and response capabilities are also driven by growing recognition among today's interconnected business communities that organizations must assume broader responsibility for protecting themselves and their business partners.

Authors of the new RSA Security Brief also claim that most breaches today result from organizations stumbling on basic security practices. Common problems found to contribute to most breaches include: 

• Neglecting "security hygiene" – In forensic evaluations following security attacks, missed software updates frequently surface as exploited vulnerabilities.
• Relying exclusively on traditional threat prevention and detection tools – Most security teams still wait for signature-based detection tools to identify problems rather than looking for more subtle indicators of compromise on their own, even though traditional firewalls, antivirus scanners and intrusion detection systems (IDS) cannot discover the truly serious problems.
• Mistaking compliance for good security – Most compliance mandates reflect best practices that should be interpreted as minimum standards, not sufficient levels, of security.
• Inadequate user training – Many companies don't invest enough time and resources in user training, even though users today are the first line of defense against many cyber attacks.

The report's authors—all seasoned security consultants and leaders of corporate security operations centers—recommend that organizations proactively undertake objective evaluations of their security posture. Such evaluations can generate hundreds of recommendations for improvement. The authors contend that in most cases, 20 percent of recommended improvements will typically account for 80 percent of potential security benefits.

Depending on the unique needs of each organization, identifying which recommendations will yield the greatest impact can prove challenging. To help organizations determine which potential security improvements to prioritize, the RSA Security Brief identifies and elaborates on eight recommendations that, in the authors' experience, often deliver outsized positive results:

1. Conduct all-inclusive risk and security assessments
2. Locate and track high-value digital assets
3. Model threats and address top vulnerabilities
4. Master change management processes
5. Deploy security staff selectively and strategically
6. Integrate security processes and technologies to scale resources
7. Invest in threat intelligence capabilities
8. Quantify the impact of security investments

Executive Quotes

Art Coviello, Executive Chairman, RSA, The Security Division of EMC, Executive Vice President, EMC

"We believe organizations are taking a stronger interest in improving security not only to protect their information assets but also their business relationships. As more organizations take a broader community-minded view of their risks and security practices, information security will improve for all of us."

Peter M. Tran, Senior Director, Advanced Cyber Defense Practice, RSA, The Security Division of EMC

"We see security assessments trending toward improvement and a more proactive approach. There's recognition that when buyers or business partners get hacked, more and more organizations are making it a priority to evaluate the relative effectiveness of their cyber security programs."

Dylan Owen, Cybersecurity Manager for Cybersecurity and Special Missions, Raytheon Company

"Attackers look for the easiest means of compromise. That's why attacks are moving from more security-mature organizations down to less mature, typically smaller, partners. Attackers can exploit the trust relationships between companies to infiltrate well-protected targets through supply chain partners with less security experience."

About RSA Security Briefs

RSA Security Briefs provide security leaders and risk management executives with essential guidance on today's most pressing information security threats and opportunities. Each Brief is created by a select team of experts who connect experiences across organizations to share specialized knowledge on a critical security topic. Offering both big-picture insight and practical technology guidance, RSA Security Briefs are vital reading for today's forward-thinking security and risk management practitioners.

Additional Resources:

• Download RSA Security Brief, "Taking Charge of Security in a Hyperconnected World"
• RSA Speaking of Security Blog: "Remedies for SOC Enterprise Amnesia"
• Connect with RSA via Twitter, Facebook, YouTube, LinkedIn and the RSA Speaking of Security Blog and Podcast

About RSA

RSA, The Security Division of EMC, is the premier provider of intelligence-driven security solutions. RSA helps the world's leading organizations solve their most complex and sensitive security challenges: managing organizational risk, safeguarding mobile access and collaboration, preventing online fraud, and defending against advanced threats.

Combining agile controls for identity assurance, fraud detection, and data protection, robust Security Analytics and industry-leading GRC capabilities, and expert consulting and advisory services, RSA brings visibility and trust to millions of user identities, the data they create, the transactions they perform, and the IT infrastructure they rely on. For more information, please visit www.EMC.com/RSA.

RSA and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other company and product names may be trademarks of their respective owners.

SOURCE EMC Corporation