What CEOs Don’t Know About Cyber Security: Study from CyberArk

By Eric Noonan • July 5, 2016

A recent global study sheds light on the current gap between executives and their organization’s security. The study, conducted by Dimensional Research (commissioned for a project by CyberArk), surveyed the opinions of 308 IT security professionals worldwide and captured hard data on enterprise security awareness at the executive level. While more and more organizations are quickly increasing their focus on security to stay out of today’s almost weekly headlines of multimillion-dollar security breaches and lawsuits, this study shows executives, in general, are far behind the curve. Here are some highlights from the study:

Compliance (Still) Does Not Equal Security

Results showed that executives are often still relying too heavily on compliance metrics. 79% of IT security professionals surveyed said they report on compliance metrics to demonstrate the effectiveness of their enterprise’s security, while 59% of them believe that threat detection metrics are actually most important. Relying on compliance metrics can be temptingly easy for CEOs to feel complacent about their organization’s security programs. For the CEO traditionally focused on the many facets of the business side of their organization, cybersecurity is a daunting and amorphous problem to grasp. It is important to use compliance as leverage and push further for context for responsible levels of information protection. Learn more on how to Leverage Compliance as an Enabler of Cyber Security.

Executives are Not Asking the Right Questions

Checking the compliance box can be just as easy for IT security professionals, especially if that is all that is asked of them. According to the study, 61% of respondents said they think their company’s chief executive doesn’t know enough about cybersecurity. The study also discovered “60% of the IT security professionals believe their organization can be breached, and one-third of CEOs and 43% of management teams are still not regularly briefed on cybersecurity issues.” This indicates that security professionals are too often briefing their executives on too little and wrong information. Executive teams need to ask their security professionals for more than compliance and system availability metrics; they need to also ask them for the information that they think really matters. For more, see The Five Questions CEOs Should Ask to Improve Security.

When and How to Effectively Improve Security

“53% of IT security professionals said their CEO makes business decisions without regard for security implications, and 44% said their CEO doesn’t grasp the severity of the risks facing the organization.” Without experienced and trusted IT security leadership, it can be very difficult to know when and where to divert precious company resources to effectively improve the organization’s security. The study also sought the main barriers for improving organizational security, some of which were: “In the face of a growing cybersecurity skills gap, 53% cited the lack of expertise as a primary barrier; and 75% of respondents cited budgeting issues as the primary barrier to improving cybersecurity.” They also cited the top two organizational security priorities in 2016 as being endpoint security and privileged account security. For help with this organization-wide challenge, see Two Essential Elements of an Effective Cyber Security Program.

Cybersheath Blog

3 Reasons Why You Need a Privileged Access Risk Assessment

A privileged account is one used by administrators to log in to servers, networks, firewalls, databases, applications, cloud services and other systems used by your organization. These accounts give enhanced permissions that allow the privileged user to access sensitive data or modify key system functions, among other things. You can…

Incident Response – Learning the Lesson of Lessons Learned

“Those who do not learn from history are condemned to repeat it.” Over the years, variations of this famous quote have been spoken by everyone from philosophers to world leaders. The message — that we must learn from our mistakes or continue to repeat them — is also highly relevant…

What is DFARS 252.204-7012 and NIST SP 800-171?

With the Department of Defense (DoD) promising the release of an update to NIST Special Publication 800-171, it is imperative defense contractors understand what DFARS 252.204-7012 and NIST SP 800-171 Clause is and how noncompliance with the Clause will impact their business.  Compliance is mandatory for contractors doing business with…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Trace Security