(Press-News.org) Companies are spending increasing amounts on cybersecurity tools, but aren't convinced their data is truly secure and many chief information security officers believe that attackers are gaining on their defenses, according to a new RAND Corporation study.
Charting the future of cybersecurity is difficult because so much is shrouded in secrecy, no one is entirely certain of all the methods malicious hackers use to infiltrate systems and businesses do not want to disclose their safety measures, according to the report.
While worldwide spending on cybersecurity is close to $70 billion a year and growing at 10 percent to 15 percent annually, many chief information security officers believe that hackers may gain the upper hand two to five years from now, requiring a continual cycle of development and implementation of stronger and more innovative defensive measures.
"Despite the pessimism in the field, we found that companies are paying a lot more attention to cybersecurity than they were even five years ago," said Martin Libicki, co-lead author of the study and senior management scientist at RAND, a nonprofit research organization. "Companies that didn't even have a chief information security officer five years ago have one now, and CEOs are more likely to listen to them. Core software is improving and new cybersecurity products continue to appear, which is likely to make a hacker's job more difficult and more expensive."
The RAND study draws on interviews with 18 chief information security officers and details the burgeoning world of cybersecurity products. It also reviews the relationship between software quality and the processes used to discover software vulnerabilities. Insights from these elements were used to develop a model that can shed light on the relationship between organizational choices and the cost of confronting cyberattacks.
"Companies know what they spend on cybersecurity, but quantifying what they save by preventing malicious attacks is much harder to tally," said Lillian Ablon, co-lead author of the report and a researcher at RAND. "In addition, malicious hackers can be extremely sophisticated, so costly measures to improve security beget countermeasures from hackers.
"Cybersecurity is a continual cycle of trying to eliminate weaknesses and out-think an attacker. Currently, the best that defenders can do is to make it expensive for the attackers in terms of money, time, resources and research."
Libicki and Ablon say several of the study's findings surprised them. They found that it was the effect of a cyberattack on reputation -- rather than direct costs -- that worried most chief information security officers. It matters less what actual data is affected than the fact that any data is put at risk.
However, the process of estimating those losses is not particularly comprehensive, and the ability to understand and articulate an organization's risk from network penetrations in a standard and consistent manner does not exist -- and may not exist for the foreseeable future.
RAND created a framework that portrays the struggle of organizations to minimize the cost arising from insecurity in cyberspace over a 10-year period. Those costs include the losses from cyberattack, the direct costs of training users, and the direct cost of buying and using cyber safety tools.
Additional costs also must be factored in, including the indirect costs associated with restrictions on employees using their personal devices on company networks and the indirect costs of air-gapping -- ensuring a computer network is physically isolated from unsecure networks. This is particularly true for sensitive sub-networks.
The RAND study includes recommendations for both organizations and policymakers. Organizations need to determine what needs to be protected and how badly, including what machines are on a company's network, what applications are running and what privileges have been established. Employees' desire to bring their own devices and connect them to the company network also can increase vulnerabilities.
Libicki said most of the chief information security officers who were interviewed were not interested in government efforts to improve cybersecurity. However, the RAND researchers believe government could play a useful role. For example, a government guide outlining how systems fail -- similar to guides for aviation and medical fields -- could help build a body of knowledge to help educate companies with the goal of developing higher levels of cybersecurity.
INFORMATION:
The study, "The Defender's Dilemma: Charting a Course Toward Cybersecurity," can be found at http://www.rand.org. Timothy Webb also co-authored the report.
Support for the study was provided by Juniper Networks as part of a multiphase study on the future cybersecurity environment. The first study, "Markets for Cybercrime Tools and Stolen Data: Hackers' Bazaar," examined the cybercrime black markets.
The study was conducted within the Acquisition and Technology Policy Center of the RAND National Security Research Division. The division conducts research and analysis on defense and national security topics for the U.S. and allied defense, foreign policy, homeland security and intelligence communities and foundations and other nongovernmental organizations that support defense and national security analysis.
The RAND Corporation is a nonprofit institution that helps improve policy and decisionmaking through research and analysis. To sign up for RAND e-mail alerts: http://www.rand.org/newsletters.html
RAND is a registered trademark
CLEVELAND, June 10 -- The use of complementary and alternative medicine (CAM) is increasing for the treatment of menopausal symptoms but often without the guidance of a clinician. That's according to a new study reported online today in Menopause, the journal of the North American Menopause Society (NAMS). As a result, the authors suggest that healthcare providers -- in particular family medicine practitioners -- need to be more aware of the various CAM therapies and take a more active role in guiding patients through their options to more safely and effectively coordinate ...
Almost one in every 150 babies born in the UK is stillborn or dies soon after birth. A research team led from the University of Leicester has identified large differences across the UK in the numbers and rates of babies who die, even after taking account of known factors that influence the rate of death such as poverty, mother's age and ethnicity.
A new report by MBRRACE-UK*, a team of academics, clinicians and charity representatives (commissioned by the Healthcare Quality Improvement Partnership** as part of the Maternal, Newborn and Infant Clinical Outcome Review Programme), ...
Brood parasites are reproductive cheats that evolve ways of duping other birds into raising their young. Examples such as mimicry of host eggs, chicks and fledglings by brood parasitic eggs, chicks and fledglings are amongst the most iconic examples of animal deception in nature.
New research shows that adult brood parasitic female cuckoo finches have evolved plumage colours and patterns to mimic a harmless and abundant species, such as southern red bishops, to deceive possible host birds and reduce the risk of being attacked when approaching host nests to lay their eggs. ...
A young woman has become the first in the world to give birth to a healthy child after doctors restored her fertility by transplanting ovarian tissue that had been removed and frozen while she was a child.
A report of the case is published today in Human Reproduction [1], one of the world's leading reproductive medicine journals. While there have been reports of successful pregnancies after ovarian transplantation using tissue that had been removed from patients when they were adults, there have been none using tissue taken from girls before puberty and the ability of ...
Scientists at the University of Liverpool have shown that the most complete giant sauropod dinosaur, Dreadnoughtus, discovered by palaeontologists in South America in 2014, was not as large as previously thought.
Found in Patagonia, the huge fossil had almost all of the major bones intact, allowing scientists to confidently estimate its overall size - measuring in at 26 metres long.
Preserved in rock, it is thought that the animal was close to maturity but not fully grown when it died, and may have grown to be even larger. The long-necked, plant-eating dinosaur was ...
Having a hierarchical social structure with just a few well-connected leaders enables pigeon flocks to navigate more accurately on the wing, new research shows.
Hierarchical organisation also enables flocks to cope better with navigation errors made by individual birds.
Researchers from Oxford University and the Zoological Society of London created 'virtual flocks' of homing pigeons to test how different social networks affect the navigation performance of these groups. The team's simulations looked at everything from no networks (all connections between individuals ...
A single dose of the bivalent human papillomavirus (HPV) vaccine (Cervarix®, GlaxoSmithKline group of companies) may offer a similar level of protection against HPV-16/18 infections, which cause about 70% of cervical cancers, as the current two- and three-dose schedules, according to new research combining data from two large phase 3 trials published in The Lancet Oncology.
"Our findings question the number of HPV vaccine doses truly needed to protect the majority of women against cervical cancer, and suggest that a one-dose schedule should be further evaluated. ...
NEW YORK, June 9 -- The World Health Organization released its 2015 updated essential medicines list and for the first time included the progesterone contraceptive vaginal ring (CVR), a contraceptive safe and effective for lactating women in the postpartum period.
The progesterone CVR, developed by the Population Council, is an intravaginal ring that provides women who breastfeed at least four times a day with a contraceptive option as early as four weeks after giving birth. It can be used for up to a year for improved birth spacing.
'More than 220 million women in ...
UC Davis researchers have identified the molecular interactions that allow capsaicin to activate the body's primary receptor for sensing heat and pain, paving the way for the design of more selective and effective drugs to relieve pain. Their study appeared online June 8 in the journal Nature Chemical Biology.
Capsaicin is the ingredient that makes chili peppers spicy and hot. The same pathway in the body that responds to spicy food is also activated after injury or when the immune system mounts an inflammatory response to bacteria, viruses, or in the case of autoimmune ...
Our sun is a volatile star: explosions of light, energy and solar materials regularly dot its surface. Sometimes an eruption is so large it hurls magnetized material into space, sending out clouds that can pass by Earth's own magnetic fields, where the interactions can affect electronics on satellites, GPS communications or even utility grids on the ground.
The clouds can be large or small. They can be relatively slow or as fast as 3,000 miles per second, but only one component has a strong effect on how much a CME will arrange the magnetic fields in near-Earth space. ...
