Blog

Preliminary Results from the Data Security Survey

By Rich

We’ve seen an absolutely tremendous response to the data security survey we launched last month. As I write this we are up to 1,154 responses, with over 70% of respondents completing the entire survey. Aside from the people who took the survey, we also received some great help building the survey in the first place (especially from the Security Metrics community). I’m really loving this entire open research thing.

We’re going to close the survey soon, and the analysis will probably take me a couple weeks (especially since my statistics skills are pretty rudimentary). But since we have so much good data, rather than waiting until I can complete the full analysis I thought it would be nice to get some preliminary results out there.

First, the caveats. Here’s what I mean by preliminary:

These are raw results right out of SurveyMonkey. I have not performed any deeper analysis on them, such as validating responses, statistical analysis, normalization, etc. Later analysis will certainly change the results, and don’t take these as anything more than an early peek.

Got it? I know this data is dirty, but it’s still interesting enough that I feel comfortable putting it out there.

And now to some of the results:

Demographics

We had a pretty even spread of organization sizes:

Organization size
Less than 100 101-1000 1001-10000 10001-50000 More than 50000 Response Count
Number of employees/users 20.3% (232) 23.0% (263) 26.4% (302) 17.2% (197) 13.2% (151) 1,145
Number of managed desktops 25.8% (287) 26.9% (299) 16.4% (183) 10.2% (114) 1,113
  • 36% of respondents have 1-5 IT staff dedicated to data security, while 30% don’t have anyone assigned to the job (this is about what I expected, based on my client interactions).
  • The top verticals represented were retail and commercial financial services, government, and technology.
  • 54% of respondents identified themselves as being security management or professionals, with 44% identifying themselves as general IT management or practitioners.
  • 53% of respondents need to comply with PCI, 48% with HIPAA/HITECH, and 38% with breach notification laws (seems low to me).

Overall it is a pretty broad spread of responses, and I’m looking forward to digging in and slicing some of these answers by vertical and organization size.

Incidents

Before digging in, first a major design flaw in the survey. I didn’t allow people to select “none” as an option for the number of incidents. Thus “none” and “don’t know” are combined together, based on the comments people left on the questions. Considering how many people reviewed this before we opened it, this shows how easy it is to miss something obvious.

  • On average, across major and minor breaches and accidental disclosures, only 20-30% of respondents were aware of breaches.
  • External breaches were only slightly higher than internal breaches, with accidental disclosures at the top of the list. The numbers are so close that they will likely be within the margin of error after I clean them. This is true for major and minor breaches.
  • Accidental disclosures were more likely to be reported for regulated data and PII than IP loss.
  • 54% of respondents reported they had “About the same” number of breaches year over year, but 14% reported “A few less” and 18% “Many less”! I can’t wait to cross-tabulate that with specific security controls.

Security Control Effectiveness

This is the meat of the survey. We asked about effectiveness for reducing number of breaches, severity of breaches, and costs of compliance.

  • The most commonly deployed tools (of the ones we surveyed) are email filtering, access management, network segregation, and server/endpoint hardening.
  • Of the data-security-specific technologies, web application firewalls, database activity monitoring, full drive encryption, backup tape encryption, and database encryption are most commonly deployed.
  • The most common write-in security control was user awareness.
  • The top 5 security controls for reducing the number of data breaches were DLP, Enterprise DRM, email filtering, a content discovery process, and entitlement management. I combined the three DLP options (network, endpoint, and storage) since all made the cut, although storage was at the bottom of the list by a large margin. EDRM rated highly, but was the least used technology.
  • For reducing compliance costs, the top 5 rated security controls were Enterprise DRM, DLP, entitlement management, data masking, and a content discovery process.

What’s really interesting is that when we asked people to stack rank their top 3 most effective overall data security controls, the results don’t match our per-control questions. The list then becomes:

  1. Access Management
  2. Server/endpoint hardening
  3. Email filtering

My initial analysis is that in the first questions we focused on a set of data security controls that aren’t necessarily widely used and compared between them. In the top-3 question, participants were allowed to select any control on the list, and the mere act of limiting themselves to the ones they deployed skewed the results. Can’t wait to do the filtering on this one.

We also asked people to rank their single least effective data security control. The top (well, bottom) 3 were:

  1. Email filtering
  2. USB/portable media encryption or device control
  3. Content discovery process

Again, these correlate with what is most commonly being used, so no surprise. That’s why these are preliminary results – there is a lot of filtering/correlation I need to do.

Security Control Deployment

Aside from the most commonly deployed controls we mentioned above, we also asked why people deployed different tools/processes. Answers ranged from compliance, to breach response, to improving security, and reducing costs.

  • No control was primarily deployed to reduce costs. The closest was email filtering, at 8.5% of responses.
  • The top 5 controls most often reported as being implemented due to a direct compliance requirement were server/endpoint hardening, access management, full drive encryption, network segregation, and backup tape encryption.
  • The top 5 controls most often reported as implemented due to an audit deficiency are access management, database activity monitoring, data masking, full drive encryption, and server/endpoint hardening.
  • The top 5 controls implemented for cost savings were reported as email filtering, server/endpoint hardening, access management, DLP, and network segregation.
  • The top 5 controls implemented primarily to respond to a breach or incident were email filtering, full drive encryption, USB/portable media encryption or device control, endpoint DLP, and server/endpoint hardening.
  • The top 5 controls being considered for deployment in the next 12 months are USB/portable media encryption or device control (by a wide margin), DLP, full drive encryption, WAF, and database encryption.

Again, all this is very preliminary, but I think it hints at some very interesting conclusions once I do the full analysis.

No Related Posts
Comments

In response to Steve A: Enterprise DRM has taken a long time to really mature, but in recent months interest has gained significantly. I can’t talk about specifics on a public forum but we are implementing EDRM, or IRM as we call it in Oracle, with a wide variety of customers in oil & gas, high tech, finance, national security, education and health care.

I think that many are realizing disk, location and network based encryption of documents and emails doesn’t do anything for situations where your data ends up on laptops and USB keys of partners, customers and suppliers with whom you can’t install such technologies. Also many of the location based solutions don’t protect the content whilst in use, e.g. once the PDF/XLS/DOC/PPT/HTML etc is opened in an application, an end user can save, email, upload or cut and paste information where they like. IRM provides a level of persistent protection which ensures the information is always under control and never in the clear.

By Simon Thorpe


A very interesting survey indeed. There has been an increase in the interest in EDRM (or often called IRM by Oracle, EMC and Microsoft) both as a security solution on its own and also we’ve been seeing requests from the DLP vendors to integrate IRM with their DLP network and endpoint technologies.

I wrote up a response to these initial results and i’m looking forward to you making the full set of data public later on.

http://blogs.oracle.com/irm/2010/07/preliminary_results_from_secur.html

By Simon Thorpe


Shrdlu-

We asked about effectiveness two different ways, and I need to correlate the answers. The first was asking if the control reduced the number of breaches, severity, or associated compliance costs. The second was just “effectiveness”. That way I can try to correlate results.

By Rich


ds-

Absolutely. Our sponsor gets them for 45 days exclusive, then we open the full (anonymized) data set to everyone.

By Rich


I forget if you’ve mentioned this previously, but in addition to the interpreted findings, will you also be releasing the complete survey results?

By ds


It would be very interesting to learn how the respondents defined “effectiveness” for the security controls they chose.  Did they really mean “it stopped breaches,” or did they mean “it was the least troublesome for them and their users”?

I know there are some products out there that would probably be very good at stopping breaches, but they’re also really good at stopping the business.

By shrdlu


Rich - very interesting.  Re: breach notification, can’t understand how your could be governed by PCI or HIPAA and not have breach notification requirements too!  That’s scary that people don’t know!!  And I agree, being able to select “no incidents” would makem sense.

User Awareness -  - should have been on the list… and who the heck is doing Enterprise DRM????

By Steve A


If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account.