How are enterprises coping with the security challenges brought on by digital transformation initiatives?

451 Research has polled IT decision makers at 400 larger companies about the current state of cybersecurity in their organizations, the security initiatives they have planned, the challenges they face, and how they are accommodating emerging technologies and digital transformation initiatives.

The survey, performed on behalf of eSentire, revealed several interesting thins, including some unexpected contradictions.

For example: 97 percent of the respondents believe their sensitive information is well-protected and 92 percent believe their organization has the tools and expertise to protect an increasingly diverse and disparate infrastructure, despite 56 percent saying their organizations had experienced a significant security incident, cyberattack, or data breach in the past 12 months.

“SMEs are reporting higher levels of confidence compared to that of their larger peers that often have more resources, staff, tools and specialized expertise. This high level of confidence, or overconfidence, is not backed by risk assessment data and seems to stem from comparison to the organizations’ abilities and cybersecurity posture of the past and not in light of the present or future,” infosec analyst Aaron Sherrill pointed out.

“Considering the increasing volume and sophistication of malicious attacks, the increase in regulatory requirements, the rapid adoption of new technologies and the ever-increasing complexity of a rapidly expanding hybrid IT ecosystem organizations should remain skeptical about their cybersecurity posture.”

Companies are opting for hybrid IT environments

Previous 451 Research surveys revealed that, nowadays, most organizations have dedicated security budgets and that 87 percent of organizations are increasing security budgets by an average of 22 percent for the coming year.

Personnel costs amount to over one-third of those budgets and the wedge continue to expand. Money allocated for the purchase of security tools amounts to 43 percent of security budgets, but that percentage is trending down as there is an increasing shift toward managed services and personnel costs.

Most companies (57%) are also shifting their primary workload environments from on-premises resources and infrastructure to a hybrid IT environment that leverages both on-premises systems and off-premises cloud/hosted resources in an integrated fashion. 19% are shifting to a completely off-premises public cloud environment composed of IaaS, PaaS and/or SaaS.

Skills shortage

The overwhelming majority of organizations have at least five dedicated security professionals on staff and most employ more:

But while the majority (87%) say that they have enough information security personnel on staff to support their organization, most are also looking to add specialized security experts to their teams as they are facing an expertise or skills gap in several key areas (network security, IoT security, risk analysis, threat detection and hunting, etc.)

“The greatest skills gaps for many security teams is around public cloud security expertise. This gap is increasing the probability that workloads will be improperly deployed and secured, especially as cloud platforms continue to introduce new capabilities and features at record speed,” Sherrill noted.

He also pointed out that while data security, governance and privacy are the top pains for most organizations, hybrid or multi-cloud security and securing emerging technologies are quickly becoming the most pressing challenges for many organizations.

“Digital transformation and the distribution of the workforce not only scatters resources and assets, but continues to drive a divide between corporate confidence and actual ability to protect their interests in a transformed workplace and economy,” says Mark Sangster, Vice President and Industry Security Strategist at eSentire.

“An example drill-down exposes that having satisfactory staffing levels does not ensure that the firm is equipped with critical expertise and competencies to detect threats across a perimeter less environment, nor is prepared to manage those threats once discovered. Cyber adversaries are as prepared to embrace digital transformation, and exploit the lag between the time organizations adopt emerging technology, and then retrofit security programs and staff to properly protect their assets in this new, self-inflicted risk paradigm.”