IT managers lack visibility to about 45% of their organization’s network traffic, creating significant security challenges. In fact, nearly a quarter of them are blind to as much as 70% of their network traffic.
Sophos’s global survey, The Dirty Secrets of Network Firewalls, polled more than 2,700 IT decision-makers from midsized businesses in 10 countries, including the US, Canada, Mexico, France, Germany, UK, Australia, Japan, India and South Africa – and found that, unsurprisingly, 84% of respondents agree that a lack of application visibility is a serious security concern.
Without the ability to identify what’s running on their network, IT managers are blind to ransomware, unknown malware, data breaches and other advanced threats, as well as potentially malicious applications and rogue users. Sophos pointed out that network firewalls with signature-based detection are unable to provide adequate visibility into application traffic due to a variety of factors, such as the increasing use of encryption, browser emulation and advanced evasion techniques.
“If you can’t see everything on your network, you can’t ever be confident that your organization is protected from threats. IT professionals have been ‘flying blind’ for too long and cybercriminals take advantage of this,” said Dan Schiappa, senior vice president and general manager of products at Sophos. “With governments worldwide introducing stiffer penalties for data breach and loss, knowing who and what is on your network is becoming increasingly important. This dirty secret can’t be ignored any longer.”
On average, organizations spend seven working days remediating 16 infected machines per month. Smaller organizations (100–1,000 users) spend on average five working days remediating 13 machines, while larger organizations (1,001–5,000 users) spend on average 10 working days remediating 20 machines, according to the survey.
“A single network breach often leads to the compromise of multiple computers, so the faster you can stop the infection from spreading, the more you limit the damage and time needed to clean it up,” said Schiappa. “Companies are looking for the kind of next-generation, integrated network and endpoint protection that can stop advanced threats and prevent an isolated incident from turning into a widespread outbreak. Sophisticated exploits such as MimiKatz and EternalBlue reminded everyone that network protection is critical to endpoint security and vice versa. Only direct intelligence sharing between these two can reveal the true nature of who and what is operating on your network.”
IT managers are very aware that firewalls need an upgrade in protection. In fact, the survey revealed that 79% of IT managers polled want better protection from their current firewall. Ninety-nine percent want firewall technology that can automatically isolate infected computers, and 97% want endpoint and firewall protection from the same vendor, which would allow for direct sharing of security status information.