A Year After Snowden, Companies Finally Serious on Endpoint Security

How to Avoid the Costly Headaches of a Data Breach

Earlier this month we passed the one-year anniversary of the Edward Snowden revelations. I will go out on a limb and say that from June 2013 to June 2014, it was a bad year for security. The uncovering of NSA surveillance by Edward Snowden (who was also an insider threat who broke security rules to gather the information), the Target breach, the Heartbleed bug, the IE vulnerability, the rise in mobile malware, and on and on.

Even our basic assumptions about security have changed in this past year. For example, in an eSecurity Planet article, Sean Michael Kerner discussed the need for better encryption:

Snowden has repeatedly noted that encryption is the key to better security in a world with increased surveillance.

And yet, we discovered with the Heartbleed bug that encryption only goes so far. Encryption is a good place to start, but it isn’t foolproof.

To recognize the 25^th anniversary of the Internet, Avecto surveyed 500 security professionals about their views on endpoint security. What the survey found is that largely in response to the events of the past year, the majority of companies are beginning to rethink their security strategies. Perhaps more importantly, 84 percent of those surveyed said that they believe that network security will finally reach the corporate board room, in part because of the increased scrutiny of security practices. Not to pick on Target, but they have become the poster child of security breaches, and no one wants to be the next Target (pun not intended). In fact, 39 percent of respondents said the Target breach was the security event that had the most impact on their security practices. (In fact, Snowden and the NSA revelations came in at 0 percent. Not a single person said that situation led them to rethink their security practices.)

Interestingly enough, despite the overwhelming outlook that security has to be, and will be, improved, most of those surveyed said they did not experience a security problem in the past year. For example, 87 percent they did not deal with an APT attack, 72 percent said they did not have a malware attack, and 73 percent said they had no phishing attacks. I admit, I find those numbers a little hard to believe, but it may be that these companies experienced similar attacks in the past and have already improved their security practices.

Andrew Avanessian, VP of professional services at Avecto said in a release:

Securing the endpoint isn’t simply about installing antivirus software anymore. It is essential to couple traditional preventative perimeter security such as antivirus and firewalls with the proactive strategies of app whitelisting, privilege management and patching. Without these measures in place, hackers will continue to target the endpoint, malicious insiders will continue to be successful and enterprises will continue to be at risk.