Study: No One Size Fits All in Cybersecurity

While companies across the nation are pumping more money into hardening their networks and preventing cyberattacks, many are not economically optimizing their investment, a recent study found.

There is no “one-size-fits-all” strategy in cybersecurity, found a recent RAND Corp. report, “The Economics of Defense,” which was commissioned by Juniper Networks.

“It isn’t just about buying the latest tool and solving your problem,” said Bob Dix, Juniper’s vice president of global government affairs and public policy. “There needs to be a holistic approach and it needs to be driven by an enterprise examination of risk management.”

Over the next decade, the cost of managing cyberattacks will increase by 38 percent. The bulk of that increase will be due to rising costs associated with security programs, the study found. But more investment will not necessarily equate to safer networks, Dix said.

“Many of the security tools that are available on the marketplace today may solve part of the problem for part of the time, but there is no real silver bullet,” he said.

“Some of the tools have a shelf life and we have to be cognizant of that.”

Small to medium-sized businesses have different needs than larger companies and should invest only in basic tools and policies.

“Because small to medium-sized businesses have a much smaller attack surface and are less likely to face a sophisticated attacker, overinvesting in high-cost security investments would add a disproportionate cost when compared to the likelihood of a breach and the potential losses they would experience as a result,” the report said.

Larger companies — such as top defense contractors — would be wise to invest in advanced systems and make use of automation, the study found. “The likelihood that they will be targeted by an advanced attack, experience a higher volume of daily attacks or face some type of intrusion is much greater. If significant investments are not made, then losses endured due to an incident would be huge,” the report said.

The study also found that increased investments in workforce training would yield significant cost savings. A “well-staffed and knowledgeable security team is equally if not more important than investing in new tools. The best tools are not going to be effective if not properly managed,” it said.

Topics: Cyber, Cybersecurity