Beware the gap between security readiness and confidence levels, Cisco warns

“Today’s network environment is a very different state of affairs from when enterprises had maybe two things that they had to deal with – their on-premises network, which their own people ran, and then they had the internet connection. And that was it,” Nather said. “Now, with the sprawl of everything from services to applications, there’s less and less of the network that any given enterprise controls. That really impacts network resilience and other challenges.”

Companies need to build network resilience through technologies that create segmentation: microsegmentation, network sandboxes, firewalls, and network behavior anomaly detection tools that can detect irregularities from all network directions, Cisco stated. In addition, encrypted traffic analytics can help enterprises identify malicious packets of data in encrypted data traffic without having to decrypt it, so they can keep both the data and their network secure, Cisco stated.

Companies across the globe are recognizing this challenge, according to Cisco. Network protection ranks second among the top-four enterprise cybersecurity challenges. Identity intelligence, cloud reinforcement, and machine trustworthiness are other top concerns, according to the Index. “Identity protection as a major challenge, with 36% of respondents ranking it as their organization’s top cybersecurity challenge, up from 24% in 2023,” Cisco stated. “We should no longer be asking ‘can’ the user have access, but ‘should’ the user have access.”

Some other important network security trends outlined in Cisco’s Cybersecurity Readiness Index include:

• Deployments not keeping pace. Nearly three-quarters (74%) of companies are using firewalls with built-in intrusion prevention systems (IPS), but scale remains an issue. According to the index: “Of those companies that have firewalls with built-in IPS, only 55% have fully deployed them, while 26% had only done a partial deployment at the time of the survey, and another 9% had just started the deployment. It is a similar story for network behavior anomaly detection tools. Of those who deployed these tools, only 48% reported full deployment, while 38% are at a partial stage, and 12% have just started.”
• Microsegmentation deployments lagging, too. Deployments numbers are even lower for microsegmentation and encrypted traffic analytics (ETA). According to the index: “Among those who implemented micro-segmentation, 45% partially deployed, while for those who have ETA capabilities, 39% have deployed those partially and 11% have just started. Perhaps unsurprisingly as a result, only 7% of companies are in the Mature category, and 30% are in the Progressive stage of readiness in this pillar. This clearly shows that more work needs to be done as 63% of companies fall in the Formative or Beginner categories.”

• SASE uptake is slow. “As business models move from static to dynamic, organizations must look at increasingly novel approaches such as Secure Access Service Edge (SASE) to be adequately prepared to tackle the risks these shifts present,” the index stated. “While SASE is a critical solution that allows organizations to provide secure and reliable access to cloud-based applications, only 22% of organizations have deployed it. Among the companies that are still deploying SASE, only 38% said they are planning to roll out within the next 12 months.”
• Tool overload remains a risk. The traditional approach of adopting multiple cybersecurity point solutions has not delivered effective results, as 80% of respondents admitted that having multiple point solutions slowed down their team’s ability to detect, respond and recover from incidents. This raises significant concerns, as 67% of organizations said they have deployed 10 or more point solutions in their security stacks, while 25% said they have 30 or more.
• Unsecure and unmanaged devices add complexity. According to the index: “85% of organizations say their employees access company platforms from unmanaged devices, and 43% of those employees report spending 20% of their time logged onto company networks from such devices.” Additionally, 29% reported that their employees hop between at least six networks over a week.
• Cyberattacks on the rise. “When it comes to cyberattacks, there were more than 2,800 publicly disclosed data breaches in 2023 alone – involving over 8.2 billion records stolen. And the likelihood is that this is just the tip of the iceberg – with thousands more data breaches taking place in less well-known organizations.”