C-suite still largely clueless about cybersecurity: IBM study

• C-suite and CISOs not aligned on how to combat cybercriminals
• Education and engagement needed to empower C-suite

 
MANY leaders across the C-suite are confused about who the true cybersecurity adversary is and how to effectively combat them, according to a study recently released by IBM Security and IBM’s Institute for Business Value (IBV).
 
The new study, Securing the C-Suite, Cybersecurity Perspectives from the Boardroom and C-Suite, is based on interviews with 700 C-level executives from 28 countries across 18 industries, on cybersecurity in the enterprise.
 
The research excluded the CISO (chief information security officer) to get a true picture of what everyone else in C-suite thinks about cybersecurity, IBM said in a statement.
 
READ ALSO: Organisations slack on privileged access, but set to change: Gartner
 
While on paper, cybersecurity is viewed as a top concern of 68% of CxOs, and 75% believe a comprehensive security plan is important, the study found key executives need to be more engaged with CISOs beyond planning for security, and to take a more active role.
 
A major finding of the study was that 70% of CxOs think rogue individuals make up the largest threat to their organisations. The reality is that 80% of cyberattacks are driven by highly organised crime rings in which data, tools and expertise are widely shared, according to a United Nations report, IBM said.
 
The study found that a broad set of adversaries concerned the C-suite, including 54% who acknowledged crime rings were a concern, but they gave nearly equal weight of concern to competitors at 50%.
 
Over 50% of CEOs (chief executive officers) agree collaboration is necessary to combat cybercrime. Ironically, only one-third of CEOs expressed willingness to share their organisation’s cybersecurity incident information externally.
 
This exposes a resistance to widespread and coordinated industry collaboration, while hacking groups continue to perfect their ability to share information in near real-time on the Dark Web, IBM said.
 
CEOs also emphasise that external parties need to do more, asking for stronger government oversight, increased industry collaboration and cross-border information sharing – a dichotomy that needs to be resolved, IBM argued.
 
“The world of cybercrime is evolving rapidly but many C-suite executives have not updated their understanding of the threats,” said IBM Security vice president Caleb Barlow.
 
“While CISOs and the board can help provide the appropriate guidance and tools, CxOs in marketing, human resources, and finance, some of the most sensitive and data-heavy departments, should be more proactively involved in security decisions with the CISO,” he added.
 
In fact, the marketing, human resources, and finance departments represent prime targets for cybercriminals as they manage some of the most sensitive customer and employee data, manage corporate financials, and have access to banking details, IBM noted.
 
In the study, roughly 60% of CFOs, CHROs, and CMOs (chief financial/ human resource/ marketing officers) readily acknowledge they, and by extension their divisions, are not actively engaged in cybersecurity strategy and execution.
 
For example, only 57% of CHROs report they have rolled out employee training that addresses cybersecurity, a first step in getting employees engaged on cybersecurity.
 
What organisations can do
 
An overwhelming number of the CxOs surveyed (94%) believe there is some probability that their company will experience a significant cybersecurity incident in the next two years.
 
According to IBM’s analysis, 17% of the respondents feel prepared and capable to respond to these threats.
 
IBM identified standout respondents to the survey, classifying 17% as ‘Cyber-Secure’ respondents, the most prepared and capable CxOs.
 
Cyber Secure leaders are two times more likely to have incorporated C-suite collaboration into the cybersecurity programme and two times more likely to have elevated cybersecurity to a regular agenda item at the board level (click infographic below to view in full).
 

 
Cyber-Secure tips:
 

• Understand the risk: Evaluate your ecosystem for risks, conduct security risk assessments, develop education and training for employees and incorporate security into the enterprise risk plan.

• Collaborate, educate and empower: Establish a security governance programme, empower the CISO, elevate and regularly discuss cybersecurity at C-suite meetings, include the C-suite in developing an incident response plan.

• Manage risk with vigilance and speed: Implement continuous security monitoring, leverage incident forensics, share and utilise threat intelligence to secure the environment, understand where the organisation’s digital assets reside and develop mitigation plans accordingly, develop and enforce cybersecurity policies.

 
For more resources and to download the full report, go here.
 
Related Stories:
 
The C-suite and the Uber fear factor: IBM study

Saving the CIO, Part 1: Aligning business needs, fighting bureaucracy
 
The threat landscape runneth over, here’s what we need to do
 
 
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.