Australia the best in the world... at being breached

Australia may have just cleaned up at the Commonwealth Games, but it appears the nation still has a lot to learn when it comes to cybersecurity.

ServiceNow has just released the local results of "Today's State of Security Response: 'Patch Work' Demands Attention", revealing that a whopping 52 percent of Australian respondents have reported data breaches in the past year. Of all the countries investigated in the study, this is the joint highest level - shared with the Netherlands.

The survey of nearly 3,000 security professionals from nine countries around the globe (Australia, France, Germany, Japan, the Netherlands, New Zealand, Singapore, the United Kingdom, and the United States) was carried out in association with the Ponemon Institute and highlights the clear need for a new approach to respond to rising security threats.

According to the study, Australian organisations are investing 82 percent of their security resources on protection and detection functions, while neglecting the part of security they have the most control over - their response.

And the stats show that this has been costly, as of the Australian majority that has been breached in the past year, 48 percent admitted they were breached because of a known vulnerability or software flaw for which a patch was readily available.

37 percent of Australian companies were actually aware that they were vulnerable before being breached, which ServiceNow says enforces the 'overwhelming need' for an effective vulnerability response to nullify attack paths before hackers strike.

However, another problem exists as 81 percent of Australian security teams feel they aren't sufficiently staffed to patch resources in a timely manner, which again is the highest level of all the countries surveyed. And their feelings are justified, as Australia reported the second lowest levels of staffing in the world at 15 people on average.

"Organisations are focused on protecting themselves against the most sophisticated cyberattacks, yet they can dramatically improve their risk profile by focusing on the basics. Data breaches often occur because of a failure to patch vulnerabilities, yet the basic hygiene of patching is far from easy for most organisations," says ServiceNow ANZ managing director David Oakley.

"The single most impactful step businesses can take to improve their risk profile is to improve the patch management process. With the new Mandatory Data Breach Notifications Scheme now operational, this research shows the scale of the challenge that Australian businesses are facing. Patching is now a boardroom issue.

Australian organisations also reported the second slowest levels of response times to patching high priority vulnerabilities, coming in at 19.86 days on average - more than two and a half days slower than the global standard of 17.26 days.

"Australian organisations report the second highest frequency of scanning for vulnerabilities, yet the second slowest time to patch high priority issues. It's no coincidence that they also reported the highest levels, globally, of breaches occurring when the vulnerabilities were already known (37%). The scale of data breaches show that a new approach is needed," says Oakley.

As to why Australia security teams struggle with timely patching, there were a few reasons of note:

• 65 per cent in Australia (compared to 61 per cent globally) believe that the use of manual processes hinder their ability to respond to vulnerabilities
• 65 per cent in Australia (compared to 62 per cent globally) also reported that delays in vulnerability patching were caused by a lack of ability to track whether issues were being patched
• 68 per cent in Australia (compared to 65 per cent globally) said that they found it difficult to prioritise which issues should be patched first
• 54 per cent both in Australia and globally feel that attackers are outpacing businesses with their use of technology such as machine learning and artificial intelligence

"The research shows far too many teams are relying on manual processes to track issues. A staggering 68 per cent of Australian firms are using emails and spreadsheets to manage the patching process, so things slip between the cracks. This is 10 per cent higher than the global average, and underlines the need for security teams to upgrade their tools and tactics," Oakley says.

So what can they do to improve? According to the survey Australian organisations are planning to increase their headcount by almost a third in the next 12 months, with 64 percent saying they will hire staff dedicated to patching. However, the study also indicates only 2.79 of these roles will be filled on average, the lowest number of all countries surveyed.

Oakley says the strategy for organisations to hire their way out of vulnerability management shortfall is both risky and likely to fail. The skills shortage in this field is no secret with ISACA1 reporting the global shortage of cybersecurity professionals to reach two million by 2019.

"With limited skilled staff available, AI and Machine learning can help reduce the workload for security employees, and in Australia there's significant room for improvement," says Oakley.

"Just 17 per cent are already using automated tools for protecting systems, while only 27 per cent are using the tools for the response. On both measures, Australia ranks the lowest of all the countries studied."