Senior security professionals are pessimistic about cyber incident response
Nominet has announced the findings of its Cyber Confidence Report, which analysed almost 300 senior security practitioners in the UK and US. The report finds that many respondents are not confident in their organization’s cyber resilience and its ability to recover from an incident.
Many CISOs are being put in compromising positions, with 71 percent saying that their organization uses the security posture of the organization as a selling point, despite the CISOs lack of confidence in the security stack. When asked how confident they were in an organization’s final choice of security solutions, 34 percent of CISOs said that they were only somewhat or slightly confident. In addition, only 17 percent of those questioned said that the array of technology making up their security stack was completely effective.
“It is critical that security professionals and the wider business are on the same page when it comes to cyber defence,” said Stuart Reed, VP of Cyber Security at Nominet. “While it is natural that a CISO might be slightly more cautious about claiming the effectiveness of the security solutions in place – because there is no silver bullet – more than a third not being even moderately confident in the final choice of a security solution is a worry, particularly when businesses are touting the benefits of their cyber defence. This disconnect in cyber confidence should act as an alarm bell to organizations and potentially prompt some investigation and analysis.”
Bouncing back from a breach: UK vs US
The Cyber Confidence Report also looked at the level of confidence among CISOs whose organization had suffered a breach. While suffering a breach in the past 12 months didn’t impact the perception of security posture, it did impact the confidence around dealing with that type of breach again. In fact, two thirds (68 percent) of those hit by a breach in the past 12 months did not display a high level of confidence in their organization’s ability to defend and recover from a similar attack again.
There was also an interesting distinction between the UK and US. US respondents were twice as likely to be very confident in the ability of an organization to defend against a similar attack; 40 percent compared to 22 percent respectively. That was despite the fact that almost twice as many respondents in the US compared to the UK reported more than 30 breaches in the past 12 months; 20 percent compared to 11 percent.
“There is a difference between the security market in the UK and US and this is incredibly important for both vendors and third-party advisors to understand. What might reassure a CISO in the US won’t necessarily have the same effect in the UK and we need to be aware of the cultural and contextual difference to ensure that CISOs are supported and empowered to regain confidence in the security infrastructure they implement,” continued Reed.
Re-prioritising: measurement & third-party management
In terms of building confidence in the security posture of an organization, 20 percent of CISOs either didn’t test the performance of their security stack once it was in place or didn’t know if it was being tested. A lack of knowledge about the effectiveness of their security stack could be generating a lack of confidence among senior security professionals.
It is also important to look at investment decisions and how they might be contributing to the cyber confidence among senior security professionals. With 76 percent believing that cybersecurity is an increasing priority within their organization, it begs the question of where investment should be spent. Areas ranked top for investment over the next three years are cyber monitoring (16 percent), cyber resilience (14 percent) and cyber governance (12 percent).
Nominet commissioned a survey of 274 chief information security officers (CISOs), chief technology officers (CTOs), chief information officers (CIOs) and other professionals with responsibility for overseeing the cybersecurity of their organization.
Respondents were sourced from large organizations (with 2,500 employees or more) within the UK (117) and the US (157), spanning a range of industries and sectors including automotive, critical national infrastructure (CNI), finance, government, healthcare, hospitality, legal, life sciences, retail, transport and utilities.
Industry: Cyber Security
- SailPoint Integration Consultant
- Upto £75000 plus benefits
SailPoint Integration Consultant. SailPoint Integration Consultant is needed for this expanding service business to help them with complex deployment with their FTSE focused customer base. They are looking for experienced SailPoint Integration Consultants who have: • Strong solution designing experience with in depth understanding of IAM concepts and thorough understanding of Sailpoint domain. • Thorough understanding of Identity and Access Governance concepts • Leading and creating Identity & Access Management (IAM) technical architecture • Secure by Design principles in Identify Access management, Privilege Access management • Familiar with cloud architectures, data management and source control from a security perspective. This is a great opportunity to join a business that is growing and looking for individuals who want to grow and develop and work on some of the most complex Sailpoint deployments.
- CyberArk Integration Consultant
- Greater London
- upto 75,000 plus benefits
CyberArk Integration Consultant. CyberArk Integration Consultant is needed for this expanding service business to help them with complex deployment with their FTSE focused customer base. They are looking for experienced CyberArk Integration Consultants who have: • Strong solution designing experience with in depth understanding of IAM concepts and thorough understanding of CyberArk domain. • Thorough understanding of Identity and Access Governance concepts • Leading and creating Identity & Access Management (IAM) technical architecture • Secure by Design principles in Identify Access management, Privilege Access management • Familiar with cloud architectures, data management and source control from a security perspective. This is a great opportunity to join a business that is growing and looking for individuals who want to grow and develop and work on some of the most complex CyberArk deployments.
- Penetration Tester, UK based. Ability to achieve SC clearance
- United Kingdom
Experienced Penetration tester- UK based with the ability to achieve SC clearance. On-going training and development and paid certifications / renewals. Interested to hear from all areas of penetration testing, web app, infrastructure, mobile, etc. MUST have current hands on experience delivering penetration testing. Ideally from a consultancy background with experience working with multiple clients. OSCP / CREST / CHECK / Tigerscheme penetration testing experience / certifications desirable. Apply today for more details. All information kept in the strictest of confidence.
- Senior Data Privacy Specialist, London. CIPT
REF CH7875 £60,000 Senior Data Privacy Specialist, London. CIPT Senior Data Privacy Specialist needed to help advise client on project and programmes relating to Data Privacy and compliance. UK based role. Ideally looking for someone that has a strong appreciation of technology and Data Privacy that can work with clients to develop or enhance their strategies, policies, processes and techniques to manage cybersecurity risks while enabling business driven data. Certified Information Privacy Technologists (CIPT), Certified Information Privacy Professional/Europe CIPP/E experience and or certification highly desirable. Specific experience within the healthcare industry is of particular interest. All details kept in confidence Apply today for more information