UK cyber-security preparedness lags behind awareness
Awareness of cyber-security threats and the need to address it is unprecedentedly strong among global organisations. However, the awareness has not translated into preparedness, said NTT’s global survey. The disparity is stark in European companies, particularly those in the UK, said the report.
More than 90 percent respondents in the UK believe that strong cyber-security is more important than growing revenue and profit (78 percent) to their business over the next 12 months, said the survey.
"Far too few companies – only 58 percent – have a formal security policy. That’s up just one percent from last year," said the report. Of those, only 48 percent said that their employees were fully aware of the policy, putting the total number of companies with fully-understood policies at just 28 percent.
There is still a shocking failure of security policy being understood – or even known about – in the wider workforce, said Maxine Holt, enterprise technology research director at UK-based cyber-security company Ovum.
"At an IT event recently, I witnessed 60 percent of laptops left unlocked whilst unattended – this was in an environment where those individuals worked for rival companies. On a train last month I saw someone had left their locked laptop on a seat – with their user ID and password on a post-it note stuck to the laptop," she recalled.
Budgetary concerns and lack of qualified staff complicates the situation. More than 40 percent of organisations lack the necessary skills and resources to cope with the number of cyber-security threats, found the survey. The figure was 46 percent for the UK, while only 38 percent of Swiss and French companies reported a lack of qualified staff.
"Large organisations with deep pockets frequently attract skilled security people, leaving smaller enterprises to struggle with security challenges with little in-house expertise. There are pockets of initiatives taking place around the country (and indeed the globe) to build security expertise, but this is in no way sufficient to deal with today’s workforce shortages," said Ovum’s Holt.
Exacerbating the situation is the lack of coordination in cyber-security efforts, with only 72 percent of the respondents acknowledging it as a boardroom issue. "Nearly half of all respondents (45 percent) say that cyber-security is the IT department’s problem. This rises to 57 percent for C-level respondents, which demonstrates an alarming hands-off attitude to cyber-risk in the organisations concerned," said the report.
The chinks in the cyber-defence armour are increasing, so is the willingness to surrender to ransom demands. The organisations that would consider paying a ransom in 2019 remained unchanged at 33 percent, while a higher number (36 percent) conceded that they would rather pay a ransom than get a fine for non-compliance.
"Cyber-criminals have developed a more diverse and stealthy network of ransomware operations by devising intelligent ways of using the leak data for commercial and national security implications," said Azeem Aleem, VP at NTT Security. "Cyber-criminals are not bound by any rules; their attacks are shielded and hidden across the organisational network."
The monetary value of the attacks prove the gravity of the situation. According to the respondents, it will cost more than 12 percent of the organisation’s revenue to recover from a breach, up from 10.3 percent in 2018 and 9.9 percent in 2017. Respondents estimated recovery time of 66 days on average, up nine days from 57 days last year.
There is still a lack of confidence in law enforcement agencies’ capabilities to tackle these advanced attacks, Aleem observed. "Incidents have shown in the past that the moment organisations approach law enforcement agencies, cyber-criminals leak their data online, therefore undermining confidence in the security of the company."
"Security is not a do-once project. It is a culture, an approach, an ethos in an organisation. UK companies should pay more than lip-service to security, despite the challenges they should focus on developing the ability to prevent, detect, and respond to cyber-attacks, devote time and resources to building expertise in-house," said Holt.
- IAM Product/ Project Manager
- Upto €80,000 plus benefits
IAM product/project manager is need for this expanding service provider to help develop their IAM (CIAM) strategy roadmap. This role will have two main functions, to work between the front end digital team and the backend IAM development team to ensure that the current deployment of the solution runs smoothly and is fit for purpose, the Second function is to look at the business’ future digital offerings and to understand how the IAM/CIAM solution will develop with the new digital strategy, you will be looking at the future technology and the ensuring the IAM solution is fit for purpose. The business is an agile environment and you will require agile experience. This is a great opportunity to help shape a key product within the future digital strategy of this expanding service provider. We are looking for someone with both IAM and strong product management experience Project management experience would be beneficial. If you are interested speak to Robert Anderton on 0044 (0) 7957 493501 and he will be able to discuss the role in more details IAM product/project manager is needed for this expanding service provider to help develop their IAM (CIAM) strategy roadmap. This role will have two main functions, to work between the front end digital team and the backend IAM development team to ensure that the current deployment of the solution runs smoothly and is fit for purpose, the second function is to look at the business’ future digital offerings and to understand how the IAM/CIAM solution will develop with the new digital strategy, you will be looking at the future technology and the ensuring the IAM solution is fit for purpose. The business is an agile environment and you will require agile experience. This is a great opportunity to help shape a key product within the future digital strategy of this expanding service provider. We are looking for someone with both IAM and strong product management experience Project management experience would be beneficial. If you are interested then speak to Robert Anderton on 0044 (0) 7957 493501 and he will be able to discuss the role in more details
- Cyber Incident Manager, Proactive planning and management. SC
Cyber Incident Manager, Proactive planning and management. Cyber incident Manager needed to join a large and complex business to help them prepare for a cyber related incidents. SC clearance will be required. Current or the ability to achieve. This role does not require specific current hands on technical Incident response experience, but this background would give a distinct advantage. The role has two key functions: to help the business prepare for an event and to steer them through when / if that happens. The Cyber Incident response managers role will include, but not be limited to; working with internal stakeholders to develop a security incident management plan along with its and supporting policies. Developing plans and implementing strategies on how incidents are detected, reported, assessed and responded to. Engaging with leadership teams both internal and external, proactively mapping out this large business to identify and engage the various other stakeholders and their teams. Build out and document incident scenarios and their processes, ensure incident management procedures are updated, playbooks and key training etc. You should have experience working with both internal teams and external suppliers. The role will also focus on liaising with the various teams to ensure the security incident response plan is delivered effectively. CCIM, GCIH, CIPR (NCSC-Certified Cyber Incident Planning & Response) Looking to interview immediately.
- SOC Manager. SC Clearance. Immediate opportunity.
Permanent SOC Manager. SC cleared / clearable, London / Birmingham. SOC Manager needed to replace a SOC contractor I placed into a client who is due to complete their assignment at the end of March. The ability to achieve SC clearance is essential. Looking for someone that is a blend of strategic stakeholder engagement with strong technical skills. The role will sit in a relatively new SOC environment. The position is to setup, implementation and management of resources to help with the initial and on-going stages of a new SOC. Experience engaging with and managing client stakeholder relationships as well as 3rd party relationships is critical. The role will involve; setting up, implementing and fine tuning the various initial stages of a SOC environment. Experience establishing and building out technical process / operational capability, managing of technical teams (analysts, engineers and architects, creation of policy / playbooks, fine turning is key. SPLUNK is the tooling of choice… Interviewing immediately. Set up a call with me today on https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-manager-role Direct contact details Chris.Holt@dclsearch.com or 07884666351
- Security engineer. Financial Services. UK. Permanent
CH7863 Security engineer. End User . Financial Services Security Engineer needed to monitor and manage a security suite of tools within an End User environment. The Security Engiener will be responsible monitoring, configuring, fine tuning, incident management and generally improving the security tool capability. Specific experience with CyberArk, Tripwire Log Center and Tripwire Enterprise is highly desirable). Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. To book a call please use my Calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-