Dear Visitor,

Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course, available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest high-quality content, which is written by professional journalists, with the help of editors, graphic designers, and our site production and I.T. staff, as well as many other talented people who work around the clock for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or to simply disable your Ad Blocker while visiting this site.

Continue on this site freely
  HOME     MENU     SEARCH     NEWSLETTER    
CUSTOMER RELATIONSHIP MANAGEMENT NEWS. UPDATED 8 MINUTES AGO.
You are here: Home / CRM Contributed Content / ServiceNow Tells of Security Paradox
ServiceNow Research Uncovers Security's Patching Paradox
ServiceNow Research Uncovers Security's Patching Paradox
News as reported by the company Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
ServiceNow Research Uncovers Security's Patching Paradox -- 64% plan to hire for vulnerability response over the next 12 months, yet more talent alone won't solve the problem

SANTA CLARA, Calif. -- ServiceNow, Inc. (NYSE: NOW) has released new research, "Today’s State of Vulnerability Response: Patch Work Demands Attention," based on a survey conducted with the Ponemon Institute. The report uncovered security's "patching paradox" -- hiring more people does not equal better security.

While security teams plan to hire more staffing resources for vulnerability response -- and may need to do so -- they won't improve their security posture if they don't fix broken patching processes. Firms struggle with patching because they use manual processes and can't prioritize what needs to be patched first. The study found that efficient vulnerability response processes are critical because timely patching is the most successful tactic companies employed in avoiding security breaches.

ServiceNow surveyed nearly 3,000 security professionals in nine countries to understand the effectiveness of their vulnerability response tools and processes. Vulnerability response is the process companies use to prioritize and remediate flaws in software that could serve as attack vectors.

"Adding more talent alone won't address the core issue plaguing today's security teams," said Sean Convery, vice president and general manager, ServiceNow Security and Risk. "Automating routine processes and prioritizing vulnerabilities will help organizations avoid the 'patching paradox,' instead focusing their people on critical work to dramatically reduce the likelihood of a breach."

Firms plan to invest in additional staff for vulnerability response

Security teams already dedicate a significant proportion of their resources to patching. That number is set to rise:

Organizations spend 321 hours a week on average -- the equivalent of about eight full-time employees -- managing the vulnerability response process.

64% of respondents say they plan to hire more dedicated resources for patching over the next 12 months.

On average, the respondents surveyed plan to hire about four people dedicated to vulnerability response -- an increase of 50% over today’s staffing levels.

Hiring won't solve the problem: teams struggle with broken processes

Adding cybersecurity talent may not be possible. According to ISACA, a global non-profit IT advocacy group, the global shortage of cybersecurity professionals will reach 2 million by 2019. The study found that hiring won't solve the vulnerability response challenges facing organizations:

55% say that they spend more time navigating manual processes than responding to vulnerabilities.

Security teams lost an average of 12 days manually coordinating patching activities across teams.

65% say they find it difficult to prioritize what needs to be patched first.

61% say that manual processes put them at a disadvantage when patching vulnerabilities.

54% say that hackers are outpacing organizations with technologies such as machine learning and artificial intelligence.

Cyberattack volume increased by 15% last year, and severity increased by 23%.

"Most data breaches occur because of a failure to patch, yet many organizations struggle with the basic hygiene of patching," Convery said. "Attackers are armed with the most innovative technologies, and security teams will remain at a disadvantage if they don't change their approach."

Quickly detecting and patching vulnerabilities significantly reduces breach risk

Organizations that were breached struggle with vulnerability response processes compared with those organizations that weren't breached:

48% of organizations have experienced a data breach in the last two years.

A majority of breach victims (57%) said that they were breached because of a vulnerability for which a patch was already available. 34% were actually aware that they were vulnerable before they were breached.

Organizations that avoided breaches rated themselves 41% higher on the ability to patch quickly than organizations that had been breached. 37% of breach victims said they don’t scan for vulnerabilities.

"If you're at sea taking on water, extra hands are helpful to bail," Convery said. "The study shows most organizations are looking for bailers and buckets instead of identifying the size and severity of the leak."

Broken processes can be overcome

Here are five key recommendations that provide organizations with a pragmatic roadmap to improve security posture:

Take an unbiased inventory of vulnerability response capabilities.

Accelerate time-to-benefit by tackling low-hanging fruit first.

Regain time lost coordinating by breaking down data barriers between security and IT.

Define and optimize end-to-end vulnerability response processes, and then automate as much as you can.

Retain talent by focusing on culture and environment.

Additional Resources

Full Report: Today's State of Vulnerability Response, Patch Work Demands Attention
Blog: Survey: Hiring more talent alone won’t solve security's woes
For more on ServiceNow Security Operations, please visit this site.

Survey Methodology

ServiceNow commissioned the Ponemon Institute to survey nearly 3,000 IT security professionals. Respondents are based in Australia, France, Germany, Japan, the Netherlands, New Zealand, Singapore, the United Kingdom, and the United States, and represent organizations with more than 1,000 employees. The survey was administered online. Founded in 2002, the Ponemon Institute is a research center specializing in privacy, data protection, and information security policy.

About ServiceNow

ServiceNow makes work better across the enterprise. Getting simple stuff done at work can be easy, and getting complex multi-step tasks completed can be painless. Our applications automate, predict, digitize and optimize business processes and tasks, across IT, customer service, security operations and HR service delivery, creating a better experience for your employees and customers while transforming your enterprise. ServiceNow (NYSE: NOW) is how work gets done. For more information, visit: www.servicenow.com.

Image credit: iStock/Artist's concept.

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
MORE IN CRM CONTRIBUTED CONTENT
CRM DAILY
NEWSFACTOR NETWORK SITES
NEWSFACTOR SERVICES
© Copyright 2018 NewsFactor Network. All rights reserved. Member of Accuserve Ad Network.