Australian infosec pros rank own businesses as sitting ducks

A recent survey has revealed that about half of the surveyed organisations found that emerging network security technologies are not as effective as they should be and do not minimise the attacks that bring down web applications.

The survey, commissioned by Juniper networks and conducted by the Ponemon Institute, looked at 485 Australian IT and IT security professionals. Out of a perfect score of 10, these professionals rated the security of their organisations at an average of 4.5, and their ability to respond to and prevent attacks as 4.4 and 4.6, respectively. They also reported that on average, their organisations had been successfully breached about two times in the past 12 months.

"It is interesting to observe that despite being armed with emerging network security technologies, organisations in Asia Pacific find themselves to be sitting ducks for external threats," Ponemon Institute chairman and founder Larry Ponemon said in a statement.

Ponemon's report states that "Intrusion prevention (IPS) and firewalls are considered the most effective features in the control of the security of the organisation's network", yet the Defense Signals Directorate (DSD) ranks network-based IPSs 33rd on its list of top 35 strategies. For this strategy, DSD ranks the maintenance and upfront costs of supporting network-based IPSs as high, while ranking their overall security effectiveness as average.

The notion that using network-based IPSs can be a complex process is supported in Ponemon's own survey results. About half (47 percent) of the respondents reported performance degradation when using IPS with their next-generation firewall, and 29 percent were unsure of the performance effects of doing so. As such, 50 percent of respondents reported that they configured the application control features in their next-generation firewalls to only monitor and report activity.

Similar complexity concerns exist with web application firewalls, according to Ponemone's results. About 63 percent of respondents are concerned that these firewalls will block real customers and affect revenues. Just 18 percent of respondents said that they would be able to set up their organisation's web application firewall within a few hours, with the majority stating it would takes weeks to accomplish.