Companies struggling with hybrid IT and zero trust controls – Pulse Secure
Software-defined access solutions provider Pulse Secure has released a report that quantifies the threats, gaps and investment as organisations face increasing hybrid IT access challenges.
The 2019 State of Enterprise Secure Access report surveys large enterprises in the US, UK and DACH (Germany, Austria, Switzerland), uncovering business risk and impact resulting in a pivot towards extending Zero Trust capabilities to enable productivity and stem exposures to multi-cloud resources, applications and sensitive data.
While enterprises are taking advantage of cloud computing, the survey data showed all enterprises have ongoing data centre dependencies.
One-fifth of respondents anticipate lowering their data centre investment, while more than 40% indicated a material increase in private and public cloud investment.
According to the report, the shift in how organisations deliver Hybrid IT services to enable digital transformation must also take into consideration empowering a mobile workforce, supporting consumer and IoT devices in the workplace and meeting data privacy compliance obligations – all make for a challenging environment to ensure, monitor and audit access security.
"What was consistent across enterprise sizes, sectors or location was that secure access for hybrid IT is a current and growing concern with cyber threats, requirements and issues emerging from many sources,” says IDG Connect editorial director Martin Veitch.
“The reporting findings and insights should empower corporate leadership and IT security professionals to rethink how their organisations are protecting resources and sensitive data as they migrate to the cloud.”
Key Findings
The survey found the most impactful incidents were contributed by a lack of user and device access visibility and lax endpoint, authentication and authorisation access controls. Over the last 18 months, half of all companies dealt with malware, unauthorised/vulnerable endpoint use and mobile or web apps exposures.
Nearly half experienced unauthorised access to data and resources due to insecure endpoints and privileged users, as well as unauthorised application access due to poor authentication or encryption controls.
While a third expressed significant confidence, 61% of respondents indicated modest confidence in their security processes, human resources, intelligence and tools to mitigate access security threats.
The survey revealed the top access threat mitigation deficiencies:
- Defining app, data and resource access and protection requirements
- Defining, implementing and enforcing user and device access policy
- Provisioning, monitoring and enforcing BYOD and IoT device access
When survey participants were asked what they perceive as their largest operational gaps for access security, the majority identified hybrid IT application availability; user, device and mobile discovery and exposures; weak device configuration compliance; and inconsistent or incomplete enforcement.
Correspondingly, the participants stated that their organisations are stepping up their access security initiatives:
- 48% improving endpoint security, remediation prior to access
- 46% enhancing IoT discovery, isolation and access control
- 44% fortifying network and cloud access visibility and resource segmentation
The cited incidents, threat mitigation deficiencies and operational gaps are among reasons for the interest in a Zero Trust approach for access security.
A Zero Trust model authenticates, authorises and verifies users, devices, applications and resources no matter where they reside.
It encompasses proving identity, device and security state before and during a transaction; applying a least privilege access closest to the entities, applications and data; and extending intelligence to allow policies to adapt to changing requirements and conditions.
Adding to management complexity, the report also found that organisations employ three or more secure access tools per each of 13 solutions presented in the survey.
Larger companies have about 30% more tools than smaller enterprises.
Correspondingly, nearly half of respondents were open to exploring the benefits of consolidating their security tools into suites.
With the migration to the cloud, one tool of interest cited by respondents as being implemented or planned over the next 18 months is Software Defined Perimeter (SDP).
Research Highlights
- 91% of enterprises plan to increase secure access expenditure over the next 18 months; 30% anticipate an increase spend between 15% to 25%
- 44% of enterprises use data centre in conjunction with public cloud, 30% in conjunction with private cloud, and 26% utilise all three delivery environments
- 46% of large enterprises prefer data centre and private cloud; primarily preferred by financial services and UK-based companies
- 49% or more cited significant access incidents due to malware, unauthorised and vulnerable endpoint use and mobile and web app exposures - healthcare organisations experienced greater mobile and web app exposures
- 81% expressed gaps in hybrid IT application availability - financial services experienced the most business impact related to application availability
- 78% indicated the need for greater visibility of users, endpoints and mobile devices; more evident in large enterprises and those in the DACH region
- 42% will focus on refining privileged user or service account-based access – a top priority in financial services and manufacturing
- 48% stated a willingness to explore secure access tool consolidation into suites
- 56% stated a project or pilot of Software Defined Perimeter technology over the next 18 months
- Over 38% of respondents outsource secure access capabilities to Managed Security Service Providers (MSSPs) with additional MSSP usage to grow 10% by 2021
The independent research for the report, which offers key insights into the current access security landscape and the maturity of defences, was conducted by IDG Connect.
Survey respondents included more than 300 information security decision makers in enterprises with more than 1,000 employees across US, UK and DACH regions, and covered key verticals including financial services, healthcare, manufacturing and services.
source securitybriefeu
Industry: Cyber Security News
Latest Jobs
-
- VOIP / SIP App Developer. Contract. SIP | VOIP experience needed. SC Cleared Outside IR35 Contract. London
- London
- OUTSIDE IR35
-
SIP | VOIP Developer. SC Cleared Contract. London Looking for a SC Cleared SIP / VOIP Developer to develop an application that interacts with a set of voice and video signalling API’s You will also work on developing in-house applications, browser plugins and automated tooling to support secure communication systems. Responsibilities Develop an application that will manage number mapping and associated identities using commercial SBC API’s. Develop new user-facing features using React.js or other modern JavaScript frameworks. Build reusable components and front-end libraries for future use. Collaborate with the design team to translate UI/UX design wireframes into code. Work closely with backend developers to integrate front-end code with server-side logic. Conduct code reviews and provide constructive feedback to team members. Stay up-to-date on emerging technologies and industry trends to continuously improve our front-end development practices. Troubleshoot and debug issues that arise during development and in production environments. Maintain high coding standards and practices and ensure code is well-documented. Requirement Experience of developing specialist applications using REST API’s. Good knowledge of Go, Java and Python (open to alternative combinations of languages). Proficiency in front-end languages and frameworks such as HTML, CSS, JavaScript, React.js, etc. Strong understanding of web standards, responsive design, and cross-browser compatibility. Experience with version control systems such as Git. Knowledge of RESTful APIs and asynchronous request handling. Familiarity with UI/UX design principles and tools.
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1