Survey Surfaces Range of Cybersecurity Disconnects
A new survey of 300 IT professionals working in organizations with 100 or more employees conducted by Syncsort, a provider of tools for managing large amounts of data, finds 85 percent are confident in their organization’s cybersecurity even though 41 percent said their company had experienced a breach and 20 percent were unsure.
Not surprisingly, the most common type of breaches were virus/malware attacks (76 percent) and phishing (72 percent). Respondents claim 50 percent of breaches were identified in less than a day, while 26 percent were identified in less than a week. Mean time to respond was the breach metric most often met (41 percent), followed by mean time to resolve (35 percent), the survey finds.
But Terry Plath, senior vice president for support and services at Syncsort, noted many of the IT organizations are reporting results based on their own assessments and, even then, only intermittently. Nearly one-third (32 percent) of respondents said their organization only performs security audits annually, while 23 percent do so every three months and 19 percent every six months.
The most popular areas examined in audits were application security (72 percent), backup/disaster recovery processes (70 percent), network security (69 percent), antivirus programs and password policies (67 percent each).
In general, Plath said not relying on third-party auditors is basically asking internal IT organizations to evaluate their own performance, which, however well-intended, borders on insanity at a time when cyberattacks are increasingly more insidious.
The survey also notes that in the wake of a breach, only 43 percent of respondents said their organizations increased training for the IT staff.
A slightly higher number of respondents (46 percent) report increased spending on cybersecurity technology over the past three years. But only 35 percent developed or significantly updated a security program alongside that increased spending. The top three security investments include network firewall (69 percent), virus protection (66 percent) and malware protection (65 percent), while investments in newer approaches such as data tokenization (18 percent) are starting to emerge. Plath said it’s clear most organizations are continuing to plow most of their cybersecurity investments into base-level cybersecurity technologies.
In the coming year, only 23 percent said they plan to invest in intrusion prevention, while 21 percent said they intend to invest in patch management. Thirty-nine percent plan to invest in internal staffing and skills.
In terms of the biggest cybersecurity challenges, the survey identifies adoption of cloud services (28 percent), followed by growing complexity of regulations (20 percent) and insufficient IT security staffing (19 percent). Cybersecurity (42 percent) and cloud computing (35 percent) are the top two IT priorities in the coming year, the survey finds.
Given the overall number of breaches and levels of investment in cybersecurity training and technologies, it’s apparent there’s a significant disconnect between the scope of the threats to the business and the efforts being made to thwart them. The current chronic shortage of cybersecurity professionals makes it imperative for organizations to increase the cybersecurity skills of the entire IT team. But the Syncsort survey makes it all too obvious those efforts are uneven at best.
Of course, not every organization can afford to increase cybersecurity spending or divert funds from other initiatives to make more resources available. But those that can are much more likely to be resilient enough on a go-forward basis to withstand waves of cybersecurity attacks that will only get stronger in the months and years ahead.
