Sophos, a global leader in network and endpoint security, today announced the findings of its global survey, The Dirty Secrets of Network Firewalls, which revealed that IT managers cannot identify 45 percent of their organisation’s network traffic. In fact, nearly one-in-four cannot identify 70 per cent of their network traffic. The lack of visibility creates significant security challenges for today’s businesses and impacts effective network management. The survey polled more than 2,700 IT decision makers from mid-sized businesses in 10 countries including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa.
Considering the debilitating impact cyber-attacks can have on a business, it’s unsurprising that 84 per cent of respondents agree that a lack of application visibility is a serious security concern. Without the ability to identify what’s running on their network, IT managers are blind to ransomware, unknown malware, data breaches and other advanced threats, as well as potentially malicious applications and rogue users. Network firewalls with signature-based detection are unable to provide adequate visibility into application traffic due to a variety of factors such as the increasing use of encryption, browser emulation, and advanced evasion techniques.
Sumit Bansal, Managing Director of ASEAN and Korea at Sophos said, “You cannot fight a threat, if you can’t see it. Lack of visibility on networks can leave organisations struggling to investigate anomalous network activity and take remedial actions in near real-time. Cybercriminals are aware of this and are actively exploiting these blind spots to infiltrate data over a long period of time, undetected. Remediation takes time and this is not an ideal situation for organisations.”
On average, organisations spend seven working days remediating 16 infected machines per month. Smaller organisations (100-1,000 users) spend on average five working days remediating 13 machines, while larger organisations (1,001-5,000 users) spend on average 10 working days remediating 20 machines per month, according to the survey.
Bansal added, “Today’s attacks are becoming increasingly efficient, with cybercriminals requiring a single point of entry into a network to compromise a cascade of devices. The faster you are able to identify the source of entry, the higher the chances of reducing the spread of infection, resulting in less damage and damage control. Companies are looking for next-generation, integrated network and endpoint protection that have the ability to halt advanced threats, and to contain isolated incidents before it becomes a widespread issue. This need has been exploited by the likes of MimiKatz and Eternal Blue, further highlighting that network protection and endpoint security need to be able to exchange direct information through intelligence sharing in order to reveal who and what is lingering on your networks.”
IT managers are very aware that firewalls need an upgrade in protection. In fact, the survey revealed that 79 per cent of IT managers polled want better protection from their current firewall. 99 per cent want firewall technology that can automatically isolate infected computers, and 97 per cent want endpoint and firewall protection from the same vendor which allows for direct sharing of security status information.
Security is Not the Only Risk to Businesses
Following security risks, lost productivity was cited as a concern for 52 per cent of respondents when it comes to a lack of network visibility. Business productivity can be negatively impacted if IT is unable to prioritize bandwidth for critical applications.
For industries that rely on custom software to meet specific business needs, an inability to prioritise these mission critical applications over less important traffic could be costly. 50 per cent of IT professionals who had invested in custom applications admitted that their firewall could not identify the traffic and therefore were unable to maximise their return on investment. Lack of visibility also creates a blind spot for the potential transfer of illegal or inappropriate content on corporate networks, making companies vulnerable to litigation and compliance issues.
“To protect investments made into business-critical and custom applications, organisations need a network firewall that allows employees to access applications they require,” said Bansal. “Network visibility has changed to adopt a very different approach. Now, organisations can directly receive information from the network firewall and are able to now positively identify employees and allow access.”