New Cisco study identifies key factors for security success

Cisco’s new 2021 Security Outcomes Study reveals that the most effective cybersecurity services are those that use the most modern technologies, confirming the importance of adopting cloud and SaaS solutions, whilst also identifying the best ways to recruit and retain cybersecurity professionals.

The research was based on more than 4,800 IT, security and privacy professionals across 25 different countries, as well as various industries and organisational sizes. It analysed 25 security practices to determine which provided the most opportunity for strengthening organisational defences.

It concluded that change is a primary factor in cybersecurity success. On average, programmes that include a proactive, best-of-breed technology refresh strategy are 12.7% more likely to report overall security success. And a strategy to migrate to cloud and SaaS security solutions is one of the most effective ways to achieve such a refresh, since these solutions are affordable, as well as easy to deploy and integrate, while automatic updates ensure the technology is continually modernised without additional cost or effort.

Furthermore, having up-to-date security technologies such as multi-factor authentication and strong endpoint protection can provide an organisation’s executive team with greater peace of mind.

A well-integrated technology stack was identified as the second most important factor for cybersecurity success. It had a positive impact on nearly every outcome evaluated, increasing the probability of overall success by an average of 10.5%. Interestingly, the smart integration of cybersecurity technologies was also seen as inextricably linked to the attraction and retention of qualified professionals.

The difficulties of recruiting and retaining security staff are well known and the report suggests the following approach to solving the problem:

• Allocate the budget to hire top talent
• Develop a strategy that makes sense to them
• Surround them with good peers
• Give them the tools they need to succeed

The report emphasised the role that architecture and operations play in attracting and keeping top security staff. After all, absolutely no one enjoys wasting their time and talents overcoming bad technology.

Security automation was also highlighted as a means of combating wasted time and talents. There was a recognition that automation relieves rather than replaces talent. Relieving staff from mundane tasks frees them up for more challenging, enjoyable and valuable work.

Finally, Mike Hanley, Chief Information Security Officer at Cisco pointed out that “Security practitioners need to make fast, informed decisions. Yet they are often armed with dozens of tools from multiple vendors, requiring a fair amount of duct tape to get them to work together. This creates complexity, cost, and overhead”. This point reinforces the importance of integration and, indeed, the report highlights the fact that integration is the most significant factor in establishing a security culture that the entire organisation embraces