Senior security professionals are pessimistic about cyber incident response
.jpg)
Nominet has announced the findings of its Cyber Confidence Report, which analysed almost 300 senior security practitioners in the UK and US. The report finds that many respondents are not confident in their organization’s cyber resilience and its ability to recover from an incident.
Many CISOs are being put in compromising positions, with 71 percent saying that their organization uses the security posture of the organization as a selling point, despite the CISOs lack of confidence in the security stack. When asked how confident they were in an organization’s final choice of security solutions, 34 percent of CISOs said that they were only somewhat or slightly confident. In addition, only 17 percent of those questioned said that the array of technology making up their security stack was completely effective.
“It is critical that security professionals and the wider business are on the same page when it comes to cyber defence,” said Stuart Reed, VP of Cyber Security at Nominet. “While it is natural that a CISO might be slightly more cautious about claiming the effectiveness of the security solutions in place – because there is no silver bullet – more than a third not being even moderately confident in the final choice of a security solution is a worry, particularly when businesses are touting the benefits of their cyber defence. This disconnect in cyber confidence should act as an alarm bell to organizations and potentially prompt some investigation and analysis.”
Bouncing back from a breach: UK vs US
The Cyber Confidence Report also looked at the level of confidence among CISOs whose organization had suffered a breach. While suffering a breach in the past 12 months didn’t impact the perception of security posture, it did impact the confidence around dealing with that type of breach again. In fact, two thirds (68 percent) of those hit by a breach in the past 12 months did not display a high level of confidence in their organization’s ability to defend and recover from a similar attack again.
There was also an interesting distinction between the UK and US. US respondents were twice as likely to be very confident in the ability of an organization to defend against a similar attack; 40 percent compared to 22 percent respectively. That was despite the fact that almost twice as many respondents in the US compared to the UK reported more than 30 breaches in the past 12 months; 20 percent compared to 11 percent.
“There is a difference between the security market in the UK and US and this is incredibly important for both vendors and third-party advisors to understand. What might reassure a CISO in the US won’t necessarily have the same effect in the UK and we need to be aware of the cultural and contextual difference to ensure that CISOs are supported and empowered to regain confidence in the security infrastructure they implement,” continued Reed.
Re-prioritising: measurement & third-party management
In terms of building confidence in the security posture of an organization, 20 percent of CISOs either didn’t test the performance of their security stack once it was in place or didn’t know if it was being tested. A lack of knowledge about the effectiveness of their security stack could be generating a lack of confidence among senior security professionals.
It is also important to look at investment decisions and how they might be contributing to the cyber confidence among senior security professionals. With 76 percent believing that cybersecurity is an increasing priority within their organization, it begs the question of where investment should be spent. Areas ranked top for investment over the next three years are cyber monitoring (16 percent), cyber resilience (14 percent) and cyber governance (12 percent).
Methodology
Nominet commissioned a survey of 274 chief information security officers (CISOs), chief technology officers (CTOs), chief information officers (CIOs) and other professionals with responsibility for overseeing the cybersecurity of their organization.
Respondents were sourced from large organizations (with 2,500 employees or more) within the UK (117) and the US (157), spanning a range of industries and sectors including automotive, critical national infrastructure (CNI), finance, government, healthcare, hospitality, legal, life sciences, retail, transport and utilities.
source continuitycentral
Industry: Cyber Security
Latest Jobs
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- SailPoint File Access Manager Consultant/ Architect
- N/A
- discussed on applications
-
SailPoint File Access Manager (SailPoint FAM) Consultant/ Architect is required for an up coming projects, Ideally looking for someone with experience in Designing and deploying SailPoint FAM , this is a new Deployment, you will work with customer in the initial workshop phase, to understand requirements and to get the initial design, you will then be responsible for deploying the solution. This is a home based role, with some onsite visits required during the length of the project. We are looking for someone who has previous experience in Deploying SailPoint FAM (ideally done design work) Need to have experience with SharePoint and ideally Azure and Share file