The bombardment of news stories covering large company breaches has possibly added to the continuation of a reactive position towards network security. As companies become resigned to the idea that a breach will happen, they become less focused on proactively preventing intrusions.
According to the 2015 Data Breach study conducted by the Ponemon Institute, it takes on average 256 days to identify a malicious breach and a further 100 days to correct the issues at an average cost to business of £2.37 million. Rather than actively seeking out threats, companies are still operating from a defensive position.
47% of all breaches are caused by a malicious or criminal attack. The method in which they cause a breach is becoming increasingly sophisticated. Yet companies continue to react to threats in their immediate environment rather than stay on top of and prepare for emerging trends in the threat landscape.
Many companies still depend primarily on legacy technology to protect their network. Using a strategy based on detection does not protect the network or valuable business critical data. What occurs is a triaging of infected and affected systems. Fixing the problem after the fact and tending to the symptoms of an intrusion costing time and money.
Instead, companies should be looking at investing in progressive and preventative technologies. Technologies that use the collective experiences of companies to inform protection are vital to a preventative strategy. This is not to say that detection has no place any longer. Mixing both strategies of detection and prevention makes you a less appealing target and limits the damage of attacks.