A recent global study sheds light on the current gap between executives and their organization’s security. The study, conducted by Dimensional Research (commissioned for a project by CyberArk), surveyed the opinions of 308 IT security professionals worldwide and captured hard data on enterprise security awareness at the executive level. While more and more organizations are quickly increasing their focus on security to stay out of today’s almost weekly headlines of multimillion-dollar security breaches and lawsuits, this study shows executives, in general, are far behind the curve. Here are some highlights from the study:
Compliance (Still) Does Not Equal Security
Results showed that executives are often still relying too heavily on compliance metrics. 79% of IT security professionals surveyed said they report on compliance metrics to demonstrate the effectiveness of their enterprise’s security, while 59% of them believe that threat detection metrics are actually most important. Relying on compliance metrics can be temptingly easy for CEOs to feel complacent about their organization’s security programs. For the CEO traditionally focused on the many facets of the business side of their organization, cybersecurity is a daunting and amorphous problem to grasp. It is important to use compliance as leverage and push further for context for responsible levels of information protection. Learn more on how to Leverage Compliance as an Enabler of Cyber Security.
Executives are Not Asking the Right Questions
Checking the compliance box can be just as easy for IT security professionals, especially if that is all that is asked of them. According to the study, 61% of respondents said they think their company’s chief executive doesn’t know enough about cybersecurity. The study also discovered “60% of the IT security professionals believe their organization can be breached, and one-third of CEOs and 43% of management teams are still not regularly briefed on cybersecurity issues.” This indicates that security professionals are too often briefing their executives on too little and wrong information. Executive teams need to ask their security professionals for more than compliance and system availability metrics; they need to also ask them for the information that they think really matters. For more, see The Five Questions CEOs Should Ask to Improve Security.
When and How to Effectively Improve Security
“53% of IT security professionals said their CEO makes business decisions without regard for security implications, and 44% said their CEO doesn’t grasp the severity of the risks facing the organization.” Without experienced and trusted IT security leadership, it can be very difficult to know when and where to divert precious company resources to effectively improve the organization’s security. The study also sought the main barriers for improving organizational security, some of which were: “In the face of a growing cybersecurity skills gap, 53% cited the lack of expertise as a primary barrier; and 75% of respondents cited budgeting issues as the primary barrier to improving cybersecurity.” They also cited the top two organizational security priorities in 2016 as being endpoint security and privileged account security. For help with this organization-wide challenge, see Two Essential Elements of an Effective Cyber Security Program.