UK cyber-security preparedness lags behind awareness
Awareness of cyber-security threats and the need to address it is unprecedentedly strong among global organisations. However, the awareness has not translated into preparedness, said NTT’s global survey. The disparity is stark in European companies, particularly those in the UK, said the report.
More than 90 percent respondents in the UK believe that strong cyber-security is more important than growing revenue and profit (78 percent) to their business over the next 12 months, said the survey.
"Far too few companies – only 58 percent – have a formal security policy. That’s up just one percent from last year," said the report. Of those, only 48 percent said that their employees were fully aware of the policy, putting the total number of companies with fully-understood policies at just 28 percent.
There is still a shocking failure of security policy being understood – or even known about – in the wider workforce, said Maxine Holt, enterprise technology research director at UK-based cyber-security company Ovum.
"At an IT event recently, I witnessed 60 percent of laptops left unlocked whilst unattended – this was in an environment where those individuals worked for rival companies. On a train last month I saw someone had left their locked laptop on a seat – with their user ID and password on a post-it note stuck to the laptop," she recalled.
Budgetary concerns and lack of qualified staff complicates the situation. More than 40 percent of organisations lack the necessary skills and resources to cope with the number of cyber-security threats, found the survey. The figure was 46 percent for the UK, while only 38 percent of Swiss and French companies reported a lack of qualified staff.
"Large organisations with deep pockets frequently attract skilled security people, leaving smaller enterprises to struggle with security challenges with little in-house expertise. There are pockets of initiatives taking place around the country (and indeed the globe) to build security expertise, but this is in no way sufficient to deal with today’s workforce shortages," said Ovum’s Holt.
Exacerbating the situation is the lack of coordination in cyber-security efforts, with only 72 percent of the respondents acknowledging it as a boardroom issue. "Nearly half of all respondents (45 percent) say that cyber-security is the IT department’s problem. This rises to 57 percent for C-level respondents, which demonstrates an alarming hands-off attitude to cyber-risk in the organisations concerned," said the report.
The chinks in the cyber-defence armour are increasing, so is the willingness to surrender to ransom demands. The organisations that would consider paying a ransom in 2019 remained unchanged at 33 percent, while a higher number (36 percent) conceded that they would rather pay a ransom than get a fine for non-compliance.
"Cyber-criminals have developed a more diverse and stealthy network of ransomware operations by devising intelligent ways of using the leak data for commercial and national security implications," said Azeem Aleem, VP at NTT Security. "Cyber-criminals are not bound by any rules; their attacks are shielded and hidden across the organisational network."
The monetary value of the attacks prove the gravity of the situation. According to the respondents, it will cost more than 12 percent of the organisation’s revenue to recover from a breach, up from 10.3 percent in 2018 and 9.9 percent in 2017. Respondents estimated recovery time of 66 days on average, up nine days from 57 days last year.
There is still a lack of confidence in law enforcement agencies’ capabilities to tackle these advanced attacks, Aleem observed. "Incidents have shown in the past that the moment organisations approach law enforcement agencies, cyber-criminals leak their data online, therefore undermining confidence in the security of the company."
"Security is not a do-once project. It is a culture, an approach, an ethos in an organisation. UK companies should pay more than lip-service to security, despite the challenges they should focus on developing the ability to prevent, detect, and respond to cyber-attacks, devote time and resources to building expertise in-house," said Holt.
source scmagazineuk
Latest Jobs
-
- Data Privacy Lead. Client Facing London. Permanent.
- London
- N/A
-
Data Privacy Lead. Client Facing London. Permanent. London based client facing. Must be eligible to undergo UK Security Clearance (SC) Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPPPrivacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- VOIP / SIP App Developer. Contract. SIP | VOIP experience needed. SC Cleared Outside IR35 Contract. London
- London
- OUTSIDE IR35
-
SIP | VOIP Developer. SC Cleared Contract. London Looking for a SC Cleared SIP / VOIP Developer to develop an application that interacts with a set of voice and video signalling API’s You will also work on developing in-house applications, browser plugins and automated tooling to support secure communication systems. Responsibilities Develop an application that will manage number mapping and associated identities using commercial SBC API’s. Develop new user-facing features using React.js or other modern JavaScript frameworks. Build reusable components and front-end libraries for future use. Collaborate with the design team to translate UI/UX design wireframes into code. Work closely with backend developers to integrate front-end code with server-side logic. Conduct code reviews and provide constructive feedback to team members. Stay up-to-date on emerging technologies and industry trends to continuously improve our front-end development practices. Troubleshoot and debug issues that arise during development and in production environments. Maintain high coding standards and practices and ensure code is well-documented. Requirement Experience of developing specialist applications using REST API’s. Good knowledge of Go, Java and Python (open to alternative combinations of languages). Proficiency in front-end languages and frameworks such as HTML, CSS, JavaScript, React.js, etc. Strong understanding of web standards, responsive design, and cross-browser compatibility. Experience with version control systems such as Git. Knowledge of RESTful APIs and asynchronous request handling. Familiarity with UI/UX design principles and tools.
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.