The State of Network Security 2013: Attitudes and Opinions An AlgoSec Survey

Executive Summary A survey of 179 network, security and risk and compliance professionals finds that the pace of adoption of next-generation firewalls (NGFWs) has accelerated markedly in the last year. Whether using NGFWs or traditional firewalls, organizations face increasing operational and security challenges. The most significant of these challenges come from internal sources-- the need for business agility and the accidental or malicious behavior of employees. About the Survey Change management poses greatest challenge. Three-fifths of respondents noted that poor processes and visibility create significant risk in managing network devices. o o Those risks have become real problems for many organizations four out of five experienced network or application outages as a result of out-of-process changes, a nearly 4 increase from last year. An equal number have suffered outages or impaired performance from application-related rule changes. IT departments are caught between the need to respond to business imperatives and the risk of running afoul of complex rules and bringing down their systems. Adoption of next-generation firewalls up sharply; increasing work for most organizations. The number of respondents using NGFWs rose 4 from last year, with most still motivated by improved security. While the number of respondents reporting that next-gen firewalls increased their workload declined from last year, most said the new firewalls created more work. Even as organizations centralize their firewall management, time The State of Network Security 2013 survey was conducted to analyze security risks and operational challenges, and gauge the effects that next-generation firewalls are having upon IT security professionals workload. 179 respondents completed the survey, which was targeted to members of Network Operations departments (28.7% of respondents), Security Operations departments (50.6% of respondents) and Risk and Compliance departments (20.8% of respondents). There were no statistically significant differences in the responses from these three groups. The survey was administered on the show floor at RSA Conference 2013 US, held at the Moscone Center in San Francisco, CA from February 25-28, 2013. spent managing policies and making changes continues to tax IT departments as complexity rises. Insider damage dwarfs outside threats. Two-thirds of respondents rated the threat from within- whether from accidental data leakage or malicious employees as the greatest risk to security. The same proportion expressed concern that allowing employees to bring your own device increased the risk of security breaches. Policies and processes that focus on intrusion and other external threats fail to address the biggest risks facing most organizations employee errors and malice, non-corporate devices, poor visibility and manual processes. Future of cloud security remains hazy. Less than 2 of respondents said that the majority of their organization s security controls were in the cloud. And, the larger the organization, the less likely it was to have cloud-based security. The cloud is out there, but most organizations remain reluctant to count on it for security. 2 Copyright 2013, AlgoSec Inc. All rights reserved

IT Security, Network Operations and Risk and Compliance teams struggle to balance the out-ofprocess changes undertaken to maintain business agility and the control needed to ensure system security and stability using their current processes. At the same time, poor visibility and complex rules continue to expose organizations to the risk of outages and security breaches, often caused by their own employees and processes. Even those that have adopted NGFWs and centralized policy management find that the increased security still comes at the price of more changes, more policies, and more complexity. Managing Changes: The Process Is the Problem Outages and security breaches represent major problems and when it comes to managing network security devices, the greatest challenge is poor process. According to 6 of respondents, time-consuming, manual processes, lack of visibility into policies, and poor change management, are the real challenges to effectively managing network security Figure 1: What is the greatest challenge when it comes to managing network security devices in your organization? Ensuring business application connectivity 12.3% Tension between IT & InfoSec teams 8.6% Time-consuming manual processes 25.2% devices (Figure 1). Enforcing BYOD policies 16.6% Poor change management 14.1% Lack of visibility into security policies 23.3% Drilling down further into this issue, increasingly complex applications and growing demands for business agility make ad hoc or manual changes riskier than ever. Out-of-process changes caused more problems for IT departments this year than in 2012. Last year, 54.5% attributed system outages to these changes, whereas this year 76.1% said that they caused application or network outages, a 39% increase (Figure 2). 3 Copyright 2013, AlgoSec Inc. All rights reserved

Figure 2: In your organization, an out-of-process change has resulted in... 8 7 32.5% Application Outage 6 5 54.5% Network Outage 4 3 43.6% 2012 2013 2 1 20.2% 22.1% 25.8% 16.6% 23. 25.2% Data Breach System Outage Failing an Audit None of the above Outages were the dominant issue associated with out-of-process changes; they occurred three times more often than data breaches and five times more frequently than audit failures. Overall, the percentage of respondents who did not experience an event remained stable at about 25%, but the total number of negative events reported rose. Application-related rule changes create similar trouble for organizations (Figure 3) with 8 saying they have experienced outages or impaired performance as a result. 35% 3 25% 2 15% 1 5% Figure 3: Has an application-related rule change to your network security caused one of the following? 30.1% 29.4% Application outage 26.4% System outage Security breach 20.9% Decreased network performance 25.8% None of the above Application-related rule changes bring down applications about as frequently as out-ofprocess changes (30.7% versus 32.5%) and cause system outages for about 3 of respondents. More alarmingly, application rule changes caused 2 more security breaches than out-ofprocess changes, impairing security for 26.4% of respondents. 4 Copyright 2013, AlgoSec Inc. All rights reserved

Next-Generation Now Dominates Next-generation firewalls (NGFWs) are clearly gaining acceptance. The number of respondents who have adopted NGFWs reached nearly 57% in 2013, up from 41.2% in 2012 (Figure 4). 7 6 5 4 3 Figure 4: Adoption of Next-Gen Firewalls 41.2% 56.8% Of those who have adopted NGFWs, a majority, 56.5%, report that their objective is to improve protection from attacks. Other reasons for adopting NGFWs are significantly less popular; ranking second is reducing IT spend at only 39.1%, and gaining more control over access to external applications at 30.4%. 2 1 It is no surprise that with concern about attacks dominating the reasons for adopting NGFWs, over half of users, 53.8%, turn on intrusion 2012 2013 protection systems (IPS). When asked what NGFW features they use, the top three are IPS, application control (44.1%), and URL filtering (41.9%). In exchange for the increased security of NGFWs, IT professionals often must work harder (Figure 5). The majority of respondents (56%) that had adopted NGFWs said they added more work to the firewall management process, down from 76% last year. 10 9 8 7 6 5 4 3 2 1 Figure 5: Have Next-Gen Firewalls added more work to your firewall management processes? 23.9% 12.7% 22.5% 40.8% 44. 9.9% 11. 35.2% 2012 2013 No: We have a centralizedmanagement solution and/or process Yes: The added policy granularity requires more info to gather for audits Yes: The additional controls of NGFWs create additional policies that must be managed Yes: We have to manage NGFW policies separately from traditional firewall polices 5 Copyright 2013, AlgoSec Inc. All rights reserved

Interestingly, even with the 8 increase in organizations that have centralized their firewall management processes, from 24% of respondents in 2012 to more than 44% in the current survey, nearly half (46%) of respondents report they must make more changes and more than half say they spend more time managing policies. As organizations mature in their experience with NGFWs, the amount of work associated with them will gradually decline. The complexity of these systems, however, will likely mean additional work for many organizations for several years to come. Managing traditional firewalls alongside NGFWs, 24.4% Figure 6: What's the biggest challenge when it comes to managing NGFWs? Expertise to train employees, 16.7% High volume of changes, 18.9% Time to make changes, 13.3% Change management, 32.2% Defining a "nextgeneration" firewall policy, 26.7% make fewer changes, and 32.2% make about the same number of changes. Still, change management issues plague organizations with NGFWs; one-third consider them to be their biggest challenge with next-gen firewalls (Figure 6). Little wonder: when asked how the number of changes to NGFWs compares to the number of changes on traditional firewalls, 46.7% stated that they make more changes, with 28.9% making greater than 2 more changes. Only 21.2% Many organizations continue to experience a disconnect between their goals and reality with NGFWs. Although nearly 4 of NGFW-users said that reducing IT spend was a motivating factor in implementing the next-gen firewall, the majority of respondents find that NGFWs require more work and therefore more costs to manage processes and changes. While the trend is positive, more organizations need to centralize and automate their processes to see the hoped for cost reduction along with improved security. 6 Copyright 2013, AlgoSec Inc. All rights reserved

The Greatest Risk? Employees While much of the focus of IT Security, Network Operations and Risk and Compliance teams is on external threats, like last year, this year s respondents were most worried about internal perils (Figure 7). Financially- Motivated Hackers 27.6% Political "Hacktivists" 9.8% Figure 7: What is the greatest risk your organization faces today? Accidental Insider Threats (i.e. data leakage) 40.5% Employees accidentally jeopardizing security through data leaks or similar errors ranked as the greatest concern for 40.5% of this year s survey respondents. Malicious insider threats ranked second, with nearly a quarter of respondents listing it as their greatest risk. In light of the recent Matthew Keyes case, organizations may be keenly aware how easily trusted employees with access can become hackers with an agenda. Malicious Insider Threats 22.1% Employees devices create additional challenges for IT departments. Two-thirds of respondents said that permitting employees to connect their own devices to the corporate network increased the risk of security breaches and 55% said it increased network security complexity (Figure 8). 8 7 6 5 4 3 2 1 Figure 8: Do you believe that allowing employees to connect their own devices to the corporate network... (check all that apply) 67.5% Increases risk exposure to security breaches 54.6% Increases network security complexity 38.7% Creates compliance gaps 21.5% 19.6% Increases chance of a network outage Increases chance of a business application outage About 4 reported that employee devices increase the risk of network or application outages; the same percentage expressed concern about compliance issues with devices brought from home. 7 Copyright 2013, AlgoSec Inc. All rights reserved

With a more fluid flow between home and work for many employees, risks from inadvertent exposures and errant devices are likely to increase in importance for many organizations. Consequently, IT departments may want to turn their attention more toward automated processes that can defend a network against rogue or careless employees and questionable devices. Partly Cloudy for the Foreseeable Future Cloud security may be the way of the future, but relatively fewer respondents count on it in the present. Almost 6 of respondents said less than 25% of their security controls are in the cloud and less than 1 had more than 75% their security controls cloud based (Figure 9). In general, the larger the organization, the less likely it was to rely on the cloud 10 9 8 7 6 5 4 3 2 1 1 1 18% 28% 44% Conclusions Figure 9: Percent of Security Controls in the Cloud, by Company Size 1-100 employees 1 23% 57% 101-500 employees 12% 23% 19% 65% 65% 501-2000 employees for security. The most enthusiastic adopters had fewer than 100 employees, but even among those, only 28% had more than 5 of security controls in the cloud. So far, the cloud-based security has been more a topic of conversation than adoption. This year s survey reinforces the conclusions reached in the 2012 analysis: the biggest challenges for IT Security, Network Operations and Risk and Compliance teams continue to be lack of visibility, manual processes, and poor change management. In this environment, out-of-process changes are fraught with risk, with outages and security breaches among the most serious and disturbingly common possible negative outcomes. Changing application rules to boost productivity or otherwise improve operations has the opposite effect for many organizations as those changes also inadvertently cause outages, impaired performance and security breaches. 7% 9% more than 2000 more than 75% 51-75% 25-5 less than 25% The greatest threats for organizations are also increasingly from within: employees accidentally causing a data breach or security problem, malicious insiders, and unsecured or non-compliant employee devices. 8 Copyright 2013, AlgoSec Inc. All rights reserved

In the 12 months since our last report, two related trends have emerged. Next-generation firewalls are rapidly gaining acceptance, even dominance, and more organizations have centralized firewall management processes. Very likely the added process complexity of NGFWs has encouraged this streamlining. Still, the majority of organizations find that the increased security of NGFWs comes at the price of more policies and more changes to manage. Organizations adopt NGFWs for two primary reasons: to improve security and reduce costs. Moving away from manual processes and toward automated, centralized management of processes and policies will position IT organizations to fully realize the potential of NGFWs to do both. 9 Copyright 2013, AlgoSec Inc. All rights reserved

About AlgoSec AlgoSec is the market leader in network security policy management. AlgoSec enables security and operations teams to intelligently automate the policy management of firewalls, routers, VPNs, proxies and related security devices, improving operational efficiency, ensuring compliance and reducing risk. More than 1000 of the world s leading enterprises, MSSPs, auditors and consultancies rely on AlgoSec Security Management Suite for unmatched automation of firewall operations, auditing and compliance, risk analysis and the security change workflow. AlgoSec is committed to the success of every single customer, and offers the industry's only money-back guarantee. For more information, visit www.algosec.com. 265 Franklin Street Boston, MA 02110 USA T: +1-888-358-3696 F: +1-866-673-7873 E: info@algosec.com AlgoSec.com 10 Copyright 2013, AlgoSec Inc. All rights reserved