Senior security professionals are pessimistic about cyber

Nominet has announced the findings of its Cyber Confidence Report, which analysed almost 300 senior security practitioners in the UK and US. The report finds that many respondents are not confident in their organization’s cyber resilience and its ability to recover from an incident.

Many CISOs are being put in compromising positions, with 71 percent saying that their organization uses the security posture of the organization as a selling point, despite the CISOs lack of confidence in the security stack. When asked how confident they were in an organization’s final choice of security solutions, 34 percent of CISOs said that they were only somewhat or slightly confident. In addition, only 17 percent of those questioned said that the array of technology making up their security stack was completely effective.

“It is critical that security professionals and the wider business are on the same page when it comes to cyber defence,” said Stuart Reed, VP of Cyber Security at Nominet. “While it is natural that a CISO might be slightly more cautious about claiming the effectiveness of the security solutions in place – because there is no silver bullet – more than a third not being even moderately confident in the final choice of a security solution is a worry, particularly when businesses are touting the benefits of their cyber defence. This disconnect in cyber confidence should act as an alarm bell to organizations and potentially prompt some investigation and analysis.”

Bouncing back from a breach: UK vs US

The Cyber Confidence Report also looked at the level of confidence among CISOs whose organization had suffered a breach. While suffering a breach in the past 12 months didn’t impact the perception of security posture, it did impact the confidence around dealing with that type of breach again. In fact, two thirds (68 percent) of those hit by a breach in the past 12 months did not display a high level of confidence in their organization’s ability to defend and recover from a similar attack again.

There was also an interesting distinction between the UK and US. US respondents were twice as likely to be very confident in the ability of an organization to defend against a similar attack; 40 percent compared to 22 percent respectively. That was despite the fact that almost twice as many respondents in the US compared to the UK reported more than 30 breaches in the past 12 months; 20 percent compared to 11 percent.

“There is a difference between the security market in the UK and US and this is incredibly important for both vendors and third-party advisors to understand. What might reassure a CISO in the US won’t necessarily have the same effect in the UK and we need to be aware of the cultural and contextual difference to ensure that CISOs are supported and empowered to regain confidence in the security infrastructure they implement,” continued Reed.

Re-prioritising: measurement & third-party management

In terms of building confidence in the security posture of an organization, 20 percent of CISOs either didn’t test the performance of their security stack once it was in place or didn’t know if it was being tested. A lack of knowledge about the effectiveness of their security stack could be generating a lack of confidence among senior security professionals.

It is also important to look at investment decisions and how they might be contributing to the cyber confidence among senior security professionals. With 76 percent believing that cybersecurity is an increasing priority within their organization, it begs the question of where investment should be spent. Areas ranked top for investment over the next three years are cyber monitoring (16 percent), cyber resilience (14 percent) and cyber governance (12 percent).

Methodology

Nominet commissioned a survey of 274 chief information security officers (CISOs), chief technology officers (CTOs), chief information officers (CIOs) and other professionals with responsibility for overseeing the cybersecurity of their organization.

Respondents were sourced from large organizations (with 2,500 employees or more) within the UK (117) and the US (157), spanning a range of industries and sectors including automotive, critical national infrastructure (CNI), finance, government, healthcare, hospitality, legal, life sciences, retail, transport and utilities.

source continuitycentral

Industry: Cyber Security

Senior security professionals are pessimistic about cyber incident response

Senior security professionals are pessimistic about cyber incident response

Latest Jobs