Estudio de Tenable revela que el 40 % de los ciberataques violan las defensas de las organizaciones de Arabia Saudita

Tenable®, the Exposure Management company, today highlighted that, of the cyberattacks Saudi Arabian organisations experienced in the last two years, 40% were successful. This forces security teams to focus time and efforts on reactively mitigating cyberattacks, rather than preventing them in the first instance. With 68% of Saudi organisations confident that their cybersecurity practices are capable of successfully reducing the organisation’s risk exposure, there is work to be done. These findings are based on a commissioned survey of 50 Saudi-based cybersecurity and IT leaders conducted in 2023 by Forrester Consulting on behalf of Tenable.

Los encuestados mostraron particular preocupación por los riesgos asociados con la infraestructura de la nube, dada la complejidad que introduce al intentar correlacionar las identidades del usuario y del sistema, el acceso y datos de los derechos. Half of organisations (56%) say they use multi-cloud and/or hybrid cloud environments. However, over half of respondents (62%) cite cloud infrastructure as one of the highest areas of risk exposure in their organisation. In order, the highest perceived risks come from the use of public cloud infrastructure (28%), multi cloud and/or hybrid cloud (20%) and private cloud infrastructure (14%).

From the study it was evident that time is not on the security team’s side. Sixty-eight percent of respondents believe their organisation would be more successful at defending against cyberattacks if it devoted more resources to preventive cybersecurity. Yet six in 10 respondents (66%) say the cybersecurity team is too busy fighting critical incidents to take a preventive approach to reducing their organisation’s exposure.

Cyber professionals cite that a reactive stance is largely due to their organisations' struggle to obtain an accurate picture of their attack surface, including visibility into unknown assets, cloud resources, code weaknesses and user entitlement systems. La complejidad de la infraestructura, con su dependencia de múltiples sistemas en la nube, numerosas herramientas de gestión de identidades, privilegios y diversos activos web, trae consigo numerosas oportunidades de configuraciones erróneas y activos que se pasan por alto. Over half of respondents (60%) said a lack of data hygiene prevents them from drawing quality data from user privilege and access management systems, as well as from vulnerability management systems. While the majority of respondents (78%) say they consider user identity and access privileges when they prioritise vulnerabilities for patching/remediation, 62% say their organisation lacks an effective way of integrating such data into their preventive cybersecurity and exposure management practices. 

A lack of communication at the highest levels complicates and compounds the cyber problem in businesses. While attackers are continuously assessing environments, in most organisations meetings about business-critical systems take place monthly — at best. Seventy-two percent of respondents say they meet monthly with business leaders to discuss which systems are business critical, while 12% hold such meetings only once per year and 2% say they never hold such meetings.

“Far too many security teams are being overwhelmed by the sheer volume of cyberattacks they have to react to, rather than focusing efforts on reducing risks. As the attack surface becomes ever more complex, caused by trends like cloud migration and AI, this imbalance will only deepen,” said Maher Jadallah, Senior Director Middle East & North Africa, Tenable. “Firefighting is not just exhausting, but also leaves the organisation open to unacceptable risks. Security teams need to change tactic to focus instead on preventative security that deflects cyberattacks and stops threat actors gaining a toehold into the infrastructure. That will need security leadership to be involved in high-end business decision making rather than consulted after the fact. Only then will steps be taken to reduce risks and strengthen defences.”

A whitepaper is available with further results from the study, including how organisations can address the challenges and move from a reactive security posture to a preventive approach.

Acerca de Tenable
Tenable® es la empresa de Exposure Management. Aproximadamente 40 000 organizaciones de todo el mundo confían en Tenable para comprender y reducir el riesgo cibernético. Como creador de Nessus®, Tenable amplió su conocimiento sobre vulnerabilidades para ofrecer la primera plataforma del mundo para ver y proteger los activos digitales en cualquier plataforma de cómputo. Entre los clientes de Tenable, se incluye aproximadamente al 60 % de las compañías de la lista Fortune 500, aproximadamente el 40 % de las compañías de la lista Global 2000 y grandes instituciones gubernamentales. Para obtener más información, visite es-la.tenable.com.

###

Media Contact:
Tenable
[email protected]