Many organisations are stuck in a reactive mind-set when it comes to information security and would opt to pay a hacker’s ransom rather than proactively invest in security. That’s a key finding in the NTT Security Risk:Value 2018 Report
The annual survey which examines business attitudes to risk and the value of information security, reveals that responsibility for information security is not falling to any one senior executive function.
At a global level, 22 per cent of respondents believe the CIO is ‘ultimately responsible’ for managing security, compared to one in five (20 per cent) for the CEO and 19 per cent for the CISO. In the UK, fewer respondents point to the CIO (19 per cent) and CISO (18 per cent) while the CEO gets the biggest vote at 21 per cent.
“Responsibility for day-to-day security doesn’t seem to fall on any one particular person’s shoulders among our response base,” said Azeem Aleem, VP Consulting & UK&I Lead, NTT Security. “This narrow gap between the roles of CIO, CEO and CISO shows that no one executive function is stepping up to the plate. It could be a sign of unclear separation between the CIO and CISO though, as often they are the same or collaborate closely.”
Aleem continued: “On the other hand, should we be concerned that the CEO is not more involved in security matters, given the potentially damaging affects to the business, or should we be relieved that they are not managing a specialist task like this over and above other critical corporate responsibilities. The question is where do you draw the line?”
According to the Risk:Value 2018 Report, although more people see the need for regular boardroom discussions about security, their organisations are failing to raise it sufficiently at the C-suite level. While 80 per cent of all survey respondents agree that preventing a security attack should be a regular boardroom agenda item (up from 73 per cent in last year’s report) only 61 per cent say that it is, an increase of just five per cent on last year.
Lack of cohesion at the top
NTT Security’s report also suggests that this lack of cohesion at the top of the organisation means that many are struggling to secure their most important digital assets. Fewer than half (48 per cent) of respondents globally – 53 per cent in the UK – say they have fully secured all of their critical data. But with the General Data Protection Regulation (GDPR) now fully in effect, this is no longer an opportunity, but mandatory.
However, companies are beginning to take control of their data as cloud computing best practices mature. Around a quarter (27 per cent) report that the majority of their organisation’s data is currently stored on-premise or in data centres (25 per cent). However, in 12 months’ time, a similar proportion (25 per cent) of respondents say that it will be stored in a cloud environment.