SolarWinds Federal Cybersecurity Survey

© 2014 Market Connections, Inc.
SolarWinds®
Federal Cybersecurity Survey
Summary Report
March 26, 2014

SOLARWINDS FEDERAL CYYBERSECURITY SURVEY SUMMARY REPORT | MARKET CONNECTIONS, INC. | 703.378.2025
Background and Approach
2
SolarWinds and Market Connections worked together to design and conduct a blind
online cybersecurity survey among 200 federal government IT decision makers and
influencers in January and February 2014.
Throughout the report, notable significant differences are reported.
• Statistical analyses were conducted for continuous monitoring status, agency type
and job function. There were no significant differences detected by job function.
Due to rounding, graphs may not add up to 100%.
BACKGROUND AND APPROACH

3
Organizations Represented
RESPONDENT CLASSIFICATIONS
• If a respondent did not work for any of the specific organization types noted below, the survey
was terminated.
Which of the following best describes your current employer?
What agency do you work for?
1%
2%
3%
40%
56%
0% 10% 20% 30% 40% 50% 60%
Federal Legislature
Intelligence Agency
Federal Judicial Branch
Department of Defense or
Military Service
Federal, Civilian or Independent
Government Agency
Organizations Represented
Sample Organizations Represented
(In Alphabetical Order)
Air Force
Department of Transportation
(DOT)
Army Department of Treasury (TREAS)
Department of Agriculture (USDA)
Department of Veteran Affairs
(VA)
Department of Commerce (DOC)
Federal Aviation Administration
(FAA)
Department of Defense (DOD) Judicial/Courts
Department of Energy (DOE) Marine Corps
Department of Homeland Security
(DHS)
National Aeronautics and Space
Administration (NASA)
Department of Labor (DOL) Navy
Department of State (DOS)
Social Security
Administration (SSA)
Department of the Interior (DOI) US Postal Service (USPS)
N=200

4
Decision Making Involvement
RESPONDENT CLASSIFICATIONS
How are you involved in your organization’s decisions or recommendations regarding IT operations and management and IT security solutions and services? (select all
that apply)
• All respondents are knowledgeable or involved in decisions and recommendations regarding IT
operations and management and IT security solutions and services.
8%
17%
33%
40%
41%
51%
0% 10% 20% 30% 40% 50% 60%
Other involvement in IT security and/or IT
operations and management solutions
Make the final decision regarding IT security and/or
IT operations and management solutions or
contractors
Develop technical requirements for IT security
and/or IT operations and management solutions
Evaluate or recommend firms offering IT security
and/or IT operations and management solutions
Manage or implement security and/or IT operations
and management solutions
On a team that makes decisions regarding IT
security and/or IT operations and management
solutions
N=200
Note: Multiple responses allowed

14%
2%
5%
5%
15%
26%
33%
0% 10% 20% 30% 40%
Other
CSO/CISO
CIO/CTO
Security/IA director
or manager
Security/IA staff
IT director/manager
IT/IS staff
Job Function
RESPONDENT CLASSIFICATIONS 5
Which of the following best describes your current job title/function?
How long have you been working at your current agency?
Job Function and Tenure
• A variety of job functions and tenures are represented in the sample, with most being IT/IS
staff and working at their agency for over 20 years.
1%
2%
14%
21%
17%
17%
30%
0% 10% 20% 30% 40%
<1 Year
1-2 Years
3-4 Years
5-9 Years
10-14 Years
15-20 Years
20+ Years
Tenure
N=200
Includes:
• IT Procurement
• Program
Manager
N=200

6
Continuous Monitoring Plan
CONTINUOUS MONITORING IMPLEMENTATION
• Two-thirds report having implemented at least one continuous monitoring solution.
• The majority of those who have not started planning report it is due to budget constraints.
How well equipped is your agency to support federal government (ex. OMB mandate, DISA STIG, etc.) continuous monitoring requirements?
What are the reasons that you have not started planning to implement continuous monitoring? (select all that apply)
13%
4%
20%
63%
0% 20% 40% 60% 80% 100%
Don’t know
We have not started
planning
We are planning to
implement continuous
monitoring
We have implemented at
least one continuous
monitoring solution
Supporting Requirements
Non-users
37%
14%
0%
29%
43%
86%
0% 20% 40% 60% 80% 100%
Other
Lack of top-level direction
and leadership
Competing priorities and
other initiatives
Lack of manpower
Budget constraints
Reasons for Not Planning
N=200 N=7

7
Return on Investment
• Nearly half of respondents have measured the return on investment of continuous monitoring
and report it is paying off nicely.
• Of those planning to implement continuous monitoring, the majority plan to measure its
return on investment once implemented.
Have you measured the return on your investment in using continuous monitoring?
Once implemented, do you plan to measure the return on your investment in using continuous monitoring?
4%
38%
9%
49%
0% 10% 20% 30% 40% 50% 60%
No, but we feel we aren’t
getting a payoff from the
technology
No, but we feel we’re getting
our money’s worth
Yes, and we’re disappointed in
the results
Yes, it’s paying off nicely
Have Measured Return on Investment
59%
10%
31%
Plan to Measure ROI Once
Implemented
Yes
No
Unsure at
this time
N=125 N=39

8
Continuous Monitoring Benefits
What do you perceive as the top three benefits to comprehensive continuous monitoring? (select three)
5%
2%
11%
11%
14%
16%
26%
31%
31%
33%
47%
69%
0% 20% 40% 60% 80%
Not sure
Other
Increased technical collaboration with various functional areas
Automated “Score Card” report on compliance by functional area
Reduction in “Data Calls”
Reduced labor costs
Automated compliance reports
More timely visibility into results of compliance efforts
Increased visibility into current IT configurations
Keeping up with the latest compliance requirements
Keeping up with the newest vulnerabilities
More timely awareness of real-time vulnerabilities
• The majority perceive more timely awareness of real-time vulnerabilities as the top benefit to
comprehensive continuous monitoring.
= statistically significant difference
Defense Civilian
Keeping up with the
newest vulnerabilities
56% 40%
N=200

CYBERSECURITY OBSTACLES, THREATS, & EVENTS 9
How would you describe your agency’s overall cybersecurity readiness?
Cybersecurity Readiness
• The majority describe their agency’s overall cybersecurity readiness as good or excellent. A
significantly greater proportion of defense agency respondents as well as respondents that use
continuous monitoring rate their readiness as excellent.
2%
5%
50%
44%
0% 10% 20% 30% 40% 50% 60%
Not sure
Poor – we are lacking the necessary tools, process
Good – some tools, processes or polices are in place
and/or some may need updating
Excellent – we have the appropriate tools, processes
and policies in place
Continuous
Monitoring
User
Non-
User
Excellent 54% 28%
Good 44% 60%
Poor 2% 9%
Defense Civilian
Excellent 54% 37%
N=200

10
IT Security Obstacles
CYBERSECURITY OBSTACLES, THREATS, & EVENTS
• Respondents most often consider budget constraints as the single most significant high-level
obstacle to maintain or improve IT security.
What is the single most significant high-level obstacle to maintain or improve IT security at your agency?
4%
2%
4%
5%
6%
8%
14%
19%
40%
0% 10% 20% 30% 40% 50%
Other
Lack of technical solutions
available at my agency
Lack of clear standards
Lack of training for personnel
Lack of top-level direction
and leadership
Lack of manpower
Complexity of internal
environment
Competing priorities and
other initiatives
Budget constraints
N=200

11
Tool Implementation Frustrations
What are the biggest frustrations an IT manager in your agency faces in implementing cyber security tools? (select all that apply)
2%
9%
12%
18%
20%
23%
26%
26%
29%
29%
32%
42%
63%
0% 10% 20% 30% 40% 50% 60% 70%
Other
Agency does not enforce compliance
Insufficient or inflexible reporting
Difficult to update for emerging threats
Lack of executive buy-in on importance of compliance
Hidden operations costs
Difficult to implement and/or operate
High cost of training
Expensive to upgrade
Difficult to update due to evolving compliance requirements
Expensive to maintain
Organizational issues or turf battles
Lack of budget
• The majority report lack of budget is the biggest frustration an IT manager faces in
implementing cyber security tools.
Continuous
Monitoring
User
Non-
User
Lack of executive buy-in on
importance of compliance
14% 29%
N=200

9%
6%
3%
6%
18%
20%
25%
29%
36%
37%
46%
50%
0% 10% 20% 30% 40% 50% 60%
Unsure if cyber threats plague my agency
No cyber threats plague my agency
Other
APT
Physical security attacks
Mobile device theft
Denial of service
Insider data leakage/theft
SPAM
Social engineering
Malware
External hacking
12
Cybersecurity Threats
• External hacking and malware are the overall top cybersecurity threats plaguing agencies.
What types of cybersecurity threats are plaguing your agency? (select all that apply)
Continuous
Monitoring
User
Non-
User
External
hacking
57% 37%
Defense Civilian
Insider data
leakage/theft
41% 21%
Mobile device
theft
12% 25%
Physical
security attacks
25% 13%
N=200

13
Security Threat Sources
• The general hacking community and careless/untrained insiders are the largest sources of
security threats at agencies.
What are the largest sources of security threats to your agency? (select all that apply)
9%
4%
3%
6%
11%
17%
21%
26%
34%
42%
47%
0% 10% 20% 30% 40% 50%
Unsure if these threats plague my agency
None of the above plague my agency
Other
Industrial spies
For-profit crime
Malicious insiders
Terrorists
Hacktivists
Foreign governments
Careless/untrained insiders
General hacking community
Defense Civilian
General hacking
community
35% 55%
Careless/untrained
insiders
53% 35%
Foreign governments 48% 24%
Terrorists 31% 13%
Malicious insiders 26% 10%
N=200

14
Security Investment Priorities
For each of the following security practices and/or technologies, please indicate your organization’s priority level for investing resources in the next 12 months.
4%
3%
5%
4%
2%
4%
3%
4%
2%
1%
1%
1%
0%
1%
1%
1%
1%
4%
6%
4%
5%
6%
3%
3%
3%
3%
25%
24%
24%
22%
21%
22%
21%
19%
17%
67%
68%
68%
70%
71%
71%
73%
74%
78%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Vulnerability management
Improving system defenses
e.g. anti-virus, HIPS
Database security
Network configuration security compliance
continuous monitoring
Identity and access management
Server security and compliance
Improving general network defenses
e.g., firewalls, secure gateways
Firewall configuration and security
Intrusion detection and prevention
Not sure 1 Not a priority 2 Low priority 3 Medium priority 4 & 5 High or essential priority
N=200
• Firewall configuration and security continuous monitoring are the top essential priorities for
investing resources in the next 12 months.
AVG
4.19
4.19
4.10
4.11
4.02
4.10
4.02
4.04
4.00

15
Security Investment Priorities (Continued)
7%
5%
4%
4%
3%
3%
5%
4%
4%
2%
5%
3%
1%
3%
5%
3%
1%
1%
10%
14%
10%
6%
12%
12%
11%
7%
7%
34%
25%
27%
33%
25%
23%
23%
25%
25%
49%
52%
58%
58%
58%
58%
60%
64%
65%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Log management
Improving mobile device security
(mobile policy enforcement, etc.)
Implementing technologies and processes
to monitor user activity
Patch management
Secure remote systems administration
Technologies and processes to monitor and
block use of removable media (USB, etc.)
Secure document sharing
Implementing technologies and processes
to monitor information system activity
Security information and
event management
Not sure 1 Not a priority 2 Low priority 3 Medium priority 4 & 5 High or essential priority
N=200
AVG
3.88
3.93
3.73
3.70
3.72
3.81
3.70
3.55
3.58

16
Security Investment Priorities (Continued)
• Continuous monitoring users indicate that most practices and technologies are of essential
priority investments significantly more than non-users.
5 - Essential
Continuous
Monitoring User
Non-User
Firewall configuration and security continuous monitoring 53% 33%
Intrusion detection and prevention 52% 31%
Improving system defenses e.g. anti-virus, HIPS 46% 32%
Network configuration security compliance continuous
monitoring
46% 31%
Database security 44% 17%
Vulnerability management 41% 25%
Technologies and processes to monitor and block use of
removable media (USB, etc.)
37% 23%
Secure remote systems administration 36% 20%
Security information and event management 34% 20%
Patch management 33% 19%

17
Security Event Detection
How long does it typically take your organization to detect and/or analyze to the following types of security events or compliance issues?
25%
25%
27%
31%
32%
37%
40%
22%
29%
25%
23%
23%
27%
19%
24%
20%
18%
15%
14%
13%
16%
13%
12%
12%
14%
13%
10%
13%
1%
1%
3%
1%
3%
2%
4%
16%
14%
17%
17%
17%
12%
10%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Firewall rules out of compliance
New malware variant
Compromised account
External data breach
Misuse/abuse of credentials
Rogue device on network
Inappropriate internet access by insiders
Within minutes Within hours Within one day
More than one day No ability to detect Don’t know/unsure
• Respondents report most often that inappropriate internet access by insiders can be detected
within minutes.
N=200

18
Security Event Detection (Continued)
• Inappropriate sharing of documents is reported least as being able to be detected within
minutes.
14%
17%
17%
18%
20%
23%
22%
24%
25%
30%
28%
30%
11%
20%
16%
20%
21%
16%
22%
15%
19%
20%
17%
12%
14%
5%
5%
4%
2%
3%
18%
20%
19%
10%
13%
17%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Inappropriate sharing of documents
Data leakage
Non-Windows system configurations
out of compliance
Windows system configurations
out of compliance
Network device configurations
out of compliance
Spear-phishing
Within minutes Within hours Within one day
More than one day No ability to detect Don’t know/unsure
N=200

19
Security Event Detection (Continued)
• Continuous monitoring users indicate detecting and analyzing most security events or
compliance issues within minutes significantly more than non-users.
Within Minutes
Continuous
Monitoring User
Non-User
Inappropriate internet access by insiders 46% 29%
Rogue device on network 46% 23%
Misuse/abuse of credentials 37% 23%
Compromised account 34% 15%
Firewall rules out of compliance 30% 16%
Windows system configurations out of compliance 23% 8%
Data leakage 22% 8%

Contact Information
RESEARCH TO INFORM YOUR BUSINESS DECISIONS
Laurie Morrow, Director of Research Services | Market Connections, Inc.
14555 Avion Parkway, Suite 125 | Chantilly, VA 20151 | 703.378.2025, ext. 101
LaurieM@marketconnectionsinc.com
Lisa M. Sherwin Wulf, Federal Marketing Leader | SolarWinds
703.234.5386
Lisa.SherwinWulf@solarwinds.com
www.solarwinds.com/federal
@SolarWinds_Gov
20

SolarWinds Federal Cybersecurity Survey

More Related Content

What's hot (20)

Viewers also liked (9)

Similar to SolarWinds Federal Cybersecurity Survey (20)

More from SolarWinds (20)

Recently uploaded (20)

SolarWinds Federal Cybersecurity Survey