Story image

Lack of network firewall visibility causing Australian IT managers to fly blind

19 Apr 18

Network firewalls may be overrated and underperforming – particularly as Australian IT managers can’t identify 41% of their organisation’s network traffic.

As part of a global study called The Dirty Secrets of Network Firewalls, security firm Sophos found that nearly one in four IT managers across the globe can’t identify 70% of their network traffic.

The lack of visibility into traffic is a blow to organisations’ cybersecurity defences, and 87% of Australian respondents (84% globally) realise that that lack of application visibility is a serious security concern.

IT managers are blind to unknown malware, data breaches, ransomware, rogue users and malicious applications because they can’t see what’s running on their network, Sophos says.

50% of Australian IT managers say productivity is a concern relating to a lack of network visibility. Sophos says that if IT is unable to prioritise bandwidth for critical applications, it can have a negative impact on business productivity.

Accountability, legal liability and compliance, and return on investment were also cited as concerns.

“If you can’t see everything on your network, you can’t ever be confident that your organisation is protected from threats. IT professionals have been ‘flying blind’ for too long and cybercriminals take advantage of this,” adds Sophos senior vice president and general manager of products, Dan Schiappa.

“With governments worldwide introducing stiffer penalties for data breach and loss, knowing who and what is on your network is becoming increasingly important. This dirty secret can’t be ignored any longer.”

The report suggests that Australian organisations take an average of seven hours to identify, isolate, and remediate infected machines within their networks, which may be as many as 12 machines per month.

Globally, 99% of respondents want firewall technology that can automatically isolate infected computers.

Schiappa says that a single network breach can compromise many computers and it’s important to stop the spread of infection to limit damage.

 “Sophisticated exploits such as MimiKatz and EternalBlue reminded everyone that network protection is critical to endpoint security and vice versa. Only direct intelligence sharing between these two can reveal the true nature of who and what is operating on your network,” he explains.

48% of Australian IT managers say that their firewall couldn’t identify traffic coming from custom applications.

Sophos says lack of visibility also creates a blind spot for potential transfer of ‘illegal or inappropriate content’ that is hosted on corporate networks, which makes organisations privy to litigation and compliance issues.

“Organisations need a firewall that protects their investment in business-critical and custom applications by allowing employees to have prioritised access to the applications they need,” Schiappa notes.

“Increasing network visibility requires a radically different approach. By enabling the firewall to receive information directly from the endpoint security, it can now positively identify all applications – even obscure or custom applications,” he concludes.

The study polled more than 2,700 IT decision makers from mid-sized businesses in 10 countries including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India, and South Africa.

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.