One would think that with the incessant and loud buzz surrounding cybersecurity attacks making news around the world on a daily basis—be they from cyber thieves, terrorist organizations or state-sponsored—that individuals and organizations would be getting better prepared to deal with the bad guys.  Unfortunately, the release of the Cisco 2015 Annual Security Report, paints a different picture. 

In fact, as the headline to this posting and Cisco’s (News - Alert) own promotion of the report notes, what the Cisco security pros found is a widening gulf between the perception by  IT professionals that their cybersecurity tools and best practices are up to snuff vs. a reality based on implementation that they are not. 

Here are the high level findings that describe the gulf

• 60 percent of Cisco Security Capabilities Benchmark Survey respondents are not patching even basic known issues.
• Only 10 percent of Internet Explorer Users Run Latest Version.
• Yet, 90 percent of respondents are "Confident" in their cybersecurity capabilities.

In short, not only is there a major disconnect between perception and practice, but the gap between the two has grown over the years despite previous documentation of the need to be more vigilant.

Read it and weep!

For those not familiar, and you need to be, the Cisco 2015 Annual Security Report has become somewhat of a “must read” for security professionals. It examines the latest threat intelligence gathered by Cisco security experts and the results from Cisco's Security Capabilities Benchmark Study which examines the security posture of enterprises and their perceptions of their preparedness to defend themselves against cyber attacks. In addition, geopolitical trends, global developments around data localization and the importance of making cybersecurity a boardroom topic are also discussed.

Without going into all the details of the latest report, what Cisco found was that organizations must adopt an ‘all hands on deck' approach to defend against cyberattacks.  Realities are that attackers have become more proficient at taking advantage of gaps in security putting added pressure on defenders (IT security professionals) to be constantly upping their game as well. The authors add that the geopolitical motivations of the attackers and conflicting requirements imposed by local laws with respect to data sovereignty, data localization and encryption only complicate the abilities to manage cyber risks. 

 Below are few observations from the perspectives of attackers, defenders and user that should be inducement enough to download the 53 page report to obtain the granularity being its findings and conclusions.

Attackers

Cyber criminals are expanding their tactics and adapting their techniques to carry out cyber attack campaigns in ways that make it harder to detect and analyze. The top three 2014 trends that Cisco's threat intelligence has identified are:

• Snowshoe Spam: Emerging as a preferred strike method, attackers are sending low volumes of spam from a large set of IP addresses to avoid detection, creating an opportunity to leverage compromised accounts in multiple ways.
• Web Exploits Hiding in Plain Sight: Widely used exploit kits are getting dismantled by security companies in short order.  As a result, online criminals are using other less common kits to successfully carry out their tactics – a sustainable business model as it does not attract too much attention.   
• Malicious Combinations: Flash and JavaScript have historically been insecure on their own, but with advances in security detection and defenses, attackers have adapted by deploying exploits which combine their respective weaknesses. Sharing exploits over two different files – one Flash and one JavaScript – can make it more difficult for security devices to identify and block the exploit and to analyze it with reverse engineering tools.

 Users

Users are caught in the middle. Not only are they the targets, but end-users are unknowingly aiding cyber attacks. Throughout 2014, Cisco threat intelligence research revealed that attackers have increasingly shifted their focus from seeking to compromise servers and operating systems to seeking to exploit users at the browser and email level. Users downloading from compromised sites contributed to a 228 percent increase in Silverlight attacks along with a 250 percent increase in spam and malvertising exploits.

Defenders

Results from the Cisco Security Capabilities Benchmark Study, which surveyed Chief Information Security Officers (CISOs) and Security Operations (SecOps) executives at 1700 companies in nine countries reveals a widening gap in defender perceptions of their likely security capabilities. 

Specifically, the study indicates that 75 percent of CISOs see their security tools as very or extremely effective.  However, less than 50 percent of respondents use standard tools such as patching and configuration to help prevent security breaches and ensure that they are running the latest versions.  Heartbleed was the landmark vulnerability last year, yet 56 percent of all installed OpenSSL versions are over four years old.  That is a strong indicator that security teams are not patching.

 While many defenders believe their security processes are optimized—and their security tools are effective—in truth, their security readiness likely needs improvement. 

 The report findings conclude that it's time for corporate boards to take a role in setting security priorities and expectations. 

The Cisco "Security Manifesto", a formal set of security principles as a foundation to achieving security, can help corporate boards, security teams and users in an organization better understand and respond to the cybersecurity challenges of today's world. It can serve as a baseline for organizations as they strive to become more dynamic in their approach to security and more adaptive and innovative than adversaries.  The principles are:

1. Security must support the business.
2. Security must work with existing architecture – and be usable.
3. Security must be transparent and informative.
4. Security must enable visibility and appropriate action.
5. Security must be viewed as a "people problem."

John N. Stewart, senior vice president, chief security and trust officer, Cisco summarized the findings and Cisco’s recommendations in the video embedded which is more than worth a review.

John N. Stewart, Chief Security Officer at Cisco, highlights the findings of Cisco's 2015 Annual Security Report

They track closely with his published statement: 

"Security needs an all hands on deck approach, where everybody contributes, from the board room to individual users. We used to worry about DoS, now we also worry about data destruction. We once worried about IP theft, now we worry about critical services failure. Our adversaries are increasingly proficient, exploit our weaknesses and hide their attacks in plain sight. Security must provide protection across the full attack continuum and technology must be bought that is designed and built with that in mind. Online services must be run with resiliency in mind, and all of these moves must happen now to tip the scales and protect our future. It requires leadership, cooperation, and accountability like never seen before in our industry."

The Cisco Report is good because of its high visibility. That said, when it comes to looking at the cyber security landscape, it is amplifying what a series of reports in the past two years have stressed almost ad nausea:

• We all, security professionals, organizations and individual end users share in the responsibilities for assuring increased cyber safety.
• Not staying current on best practices, especially patching known problems and re-configuring to prevent exploitation, is an invitation to disaster and easily done.
• End-to-end encryption is a safeguard that must be given serious consideration.
• If leadership does not make cyber safety part of their organization’s DNA, they are inviting disaster, and that means that C-levels who are at the top of the list of those who believe the rules do not apply to them, must lead by example along with through words.

Finally, as Stewart notes at the end of the report, this goes even beyond C-levels to corporate boards of organizations as well as security solutions vendors in what has to be an unprecedented level of cooperation. He feels that the future of cybersecurity hinges on boardroom engagement, and that there had best be a major sense of urgency.

There are a lot of lists and bullet points to ponder above, but maybe the most important one is the one at the end of the report (page 45) which contains the Cisco Security Manifesto: Basic Principles for Achieving Real-World Security.  There are five principles articulated:

1. Security must be considered a growth engine for the business
2. Security must work with existing architecture, and be usable
3. Security must be transparent and informative
4. Security must enable visibility and appropriate action
5. Security must be viewed as a “people problem.

The details for these are compelling. Indeed, they are a welcome conclusion for a series of findings that need to serve as the foundation for Cisco’s call to action via this manifesto.