In 2018, security vendor Tripwire published its State of Cyber Hygiene report, a survey of 306 IT security professionals. It measured how well organisations carried out the basic controls that the Center for Internet Security (CIS) groups under the term “cyber hygiene”. Those controls are monitoring, benchmarking, patching, configuring and remediating.
The headline finding concerned unknown devices. Tripwire found that 62% of organizations needed hours at best to detect new devices on their networks, and then more hours to remove any that were unauthorised. The report’s wider point was that many breaches start with neglected basics, not with sophisticated attacks.
What the survey set out to measure
The report asked how quickly and how thoroughly organisations ran routine controls. It covered device and software inventories, vulnerability scanning, patching, administrative access, configuration change detection and log review. Tripwire’s reading was that gaps in these areas weaken an organisation’s defences and raise the odds that an attack succeeds.
The six gaps
1. Slow removal of unauthorised devices
A new device might be a guest’s phone, or it might be an intruder. Tripwire noted that a malicious party connected for only a few minutes could begin doing damage. Its recommended defence was an accurate inventory of authorised devices, backed by network-level authentication.
2. Weak control of software
Thirty percent of respondents tracked less than half of the software on their networks in an asset inventory. More than 80% of organisations needed hours or longer to detect and remove unauthorised software. Tripwire recommended application whitelisting, so that only approved software runs.
3. Infrequent scanning and slow patching
Most organisations ran vulnerability scans, but 41% scanned monthly or less often. Among those using DevOps, 46% did not scan throughout the continuous integration and deployment pipeline. On patching, 44% said applying security patches took weeks, and nearly 30% said a month or more. Tripwire advised pairing scans with patch management that covers both operating systems and third-party applications, so that updates install automatically and continuously.
4. Poor control of administrative accounts
Fewer than half of respondents used dedicated workstations for administrative work. More than half did not use multifactor authentication for administrator accounts, and 43% did not require unique passwords across systems. Nearly a third said they did not change default passwords. Tripwire’s advice was to mandate password changes, deploy multifactor authentication, use dedicated and segmented admin workstations, and limit each user to the privileges their role needs.
5. Late detection of configuration changes
Over a third of companies said they struggled to enforce configuration settings. More than half took at least days to detect configuration changes. Just under 40% took days or longer to remediate the changes they found. Misconfiguration is a common factor in successful breaches and can also cause internal disruption. Tripwire recommended configuration management tools that enforce and redeploy settings automatically, in both on-premises and cloud environments.
6. Thin log monitoring
Most organisations did not send logs from critical systems to a central location. As a result, logs were often reviewed only weekly or monthly. Nearly three-quarters of respondents said they reviewed logs weekly. A quarter looked at logs only when a SIEM raised an alert. Tripwire advised collecting as many logs as possible and centralising them, so they could be aggregated, filtered and reviewed more easily.
What it meant for Asia-Pacific IT teams
The survey was not specific to Asia-Pacific. Its findings still applied to any organisation that ran mixed on-premises and cloud estates and relied on small security teams. The common thread was time. The report showed gaps measured in hours for devices and software, days for configuration changes, and weeks for patches. Tripwire’s position was that automation of inventory, patching, configuration enforcement and log collection was the practical way to shorten those windows.