Study: Security Analysts Need the Right Tools and More Support to Fight Advanced Malware

RESTON, Va., Jan. 27, 2016 /PRNewswire/ -- New research published today by ThreatTrack Security reveals security analysts within U.S. enterprises are losing ground against their cyber adversaries when compared to the same study conducted two years earlier. 80% of study participants report that defending their networks from cyberattacks has become more difficult or is the same level of difficulty, an increase of nearly 30% over the November 2013 study.

Read the report Defending Against Malware Still a Major Struggle for Most Organizations here:
http://www.threattracksecurity.com/resources/white-papers/security-analysts-say-defending-against-advanced-malware-still-a-major-struggle.aspx

"With high-profile data breaches emerging one after the other, growing security accountability within enterprises and the exponential growth in cybersecurity investments, the last two years have been transformational for the security industry," said ThreatTrack President John Lyons. "But despite access to more tools, security analysts – the most critical resource within an enterprise's cyber defense – remain ill-equipped, underfunded and understaffed in their daily battle against advanced malware."

The study underscores many challenges facing security analysts, including:

Short on Time – More than half (53%) of analysts say it takes longer than two hours to analyze a new malware sample, and only 5% can do it in less than an hour – virtually unchanged from two years ago. While a standalone malware analysis sandbox is capable of analyzing malicious code in minutes, only 17% of respondents primarily rely on such a tool for their malware analysis. Instead, 45% rely on an "integrated malware analysis feature within existing defenses," and 21% turn to a disparate "mix of specialized tools."

Lack of Resources – More than a third of respondents (34%) express concern over not having enough budget for the right tools, up from 18% two years ago. Meanwhile, 37% of security analysts lack enough highly-skilled security staff to defend their networks from advanced malware, only a slight improvement from two years ago.

Technical Challenges – Respondents say the most difficult technical challenges they face when defending their networks are:

• Complexity of malware (56%)
• Volume of malware (47%)
• Over-alerting by cybersecurity systems (35%)
• Inability to correlate data or threat intelligence to specific attacks (24%)

Executives Behaving Better – Survey respondents report fewer cases of being asked to remove malware from a computer/device used by a member of their senior leadership team for doing the following (December 2015 vs. November 2013):

• Visiting an infected pornographic website (26% vs. 40%)
• Letting a family member use a company-owned device that led to a malware infection (29% vs. 45%)
• Attaching an infected device like a USB drive or smartphone to a PC (33% vs. 47%)

The only area in which executives provided more work for their security analysts was for clicking on a malicious link in a phishing email (59% vs. 56%).

Confidence Despite Challenges – 62% of respondents say they would "personally guarantee" their company's customers that their data will be safe in 2016.

Better Breach Disclosure – Only 11% of respondents say they have investigated a data breach that was not disclosed to customers, partners or other stakeholders. This is a dramatic shift over November 2013, when 57% said they had investigated breaches that were never disclosed.

Impact of the CISO – The study also shed light on how Chief Information Security Officers (CISOs) are positively impacting the outlook and effectiveness of security analysts. For respondents working at enterprises with a CISO:

• 94% say their organization has a dedicated Incident Response Team (IRT) or Security Operations Center (SOC) in place to respond to cyberattacks, compared to just 48% for those without a CISO
• 23% say it has become easier to defend against cyberattacks in the last year, compared to just 15% for those without a CISO
• 30% cite the lack of budget as a major challenge, compared to 45% of their peers without a CISO
• 71% would personally guarantee their customer data will be safe in 2016, compared to just 42% of analysts without a CISO

The independent blind survey of 200 security professionals dealing with malware analysis within U.S. enterprises was conducted by Opinion Matters on behalf of ThreatTrack Security in December 2015.

Full survey results are available upon request.

The 2013 study Malware Analysts Have the Tools to Defend Against Cyber-Attacks, But Challenges Remain is available here.

About ThreatTrack Security Inc.
ThreatTrack Security specializes in helping organizations identify and stop Advanced Persistent Threats (APTs), targeted attacks and other sophisticated malware designed to evade the traditional cyber defenses deployed by enterprises and government agencies around the world. With more than 300 employees worldwide and backed by Insight Venture Partners and Bessemer Venture Partners, the company develops advanced cybersecurity solutions that Expose, Analyze and Eliminate the latest malicious threats, including its ThreatSecure advanced threat detection and remediation platform, ThreatAnalyzer malware behavioral analysis sandbox, ThreatIQ real-time threat intelligence service, and VIPRE business antivirus endpoint protection. Learn more at www.ThreatTrackSecurity.com.

Disclaimer
Copyright © 2015 ThreatTrack Security, Inc. All rights reserved. All other trademarks are the property of their respective owners. To the best of our knowledge, all details were correct at the time of publishing; this information is subject to change without notice.

Logo - http://photos.prnewswire.com/prnh/20140219/NE67666LOGO

SOURCE ThreatTrack Security Inc.

Related Links

http://www.threattracksecurity.com