Organisations struggling to manage cyber risk finds EY survey

The survey of 1825 chief information officers, chief information security officers, chief executive officers and other information security executives reveals that organisations are increasingly pessimistic about their ability to meet information security needs. Only 13% of respondents report that their information security function fully meets their organisation's needs, down from 17% in 2013. Last year 68% of respondents felt that their information security function partly meets their needs and that improvements are under way. This number has fallen to 63% in 2014. In the 2014 survey most organisations (67%) said they are facing rising threats from information security, but over a third admit (37%) they have no real-time insight on cyber risks in order to combat these threats.hideThe survey reveals that organisations lack the budget and skills to combat rising cybercrime. 43% of respondents say that their organisation's total information security budget will stay approximately the same in the coming 12 months despite increasing threats. This is only a marginal improvement on 2013 when 46% said budgets would not change. Over half of those surveyed (53%) said that a lack of skilled resources is one of the main obstacles challenging their information security programme. Only 5% of responding companies have a threat intelligence team with dedicated analysts. These figures also represent no material difference over 2013, when 50% highlighted a lack of skilled resources and 4% said they had a threat intelligence team with dedicated analysts. An EY report detailing the survey results entitled Get Ahead Of Cybercrime says the findings show that organisations need to do a better job of anticipating attacks in an environment where it is no longer possible to prevent all cyber breaches and threats come from ever more resourceful and well-funded sources. Paul van Kessel, EY's Global Risk Leader, said: "Too many organisations still fall short in mastering the foundational components of cybersecurity. In addition to a lack of focus at the top of the organisation and a lack of well-defined procedures and practices, too many of the organisations we surveyed reveal they do not have a security operations centre. This is a major cause for concern." "Organisations will only develop a risk strategy of the future if they understand how to anticipate cybercrime. Cyber-attacks have the potential to be far-reaching-not only financially, but also in terms of brand and reputation damage, the loss of competitive advantage and regulatory non-compliance. Organisations must undertake a journey from a reactive to a proactive posture, transforming themselves from easy targets for cybercriminals into more formidable adversaries," he added. The report encourages organisations to embrace cybersecurity as a core competitive capability. This requires keeping the organisation in a constant state of readiness, anticipating where new threats may arise and shedding the 'victim' mindset of operating in a perpetual state of anxiety, it says. In order to achieve such goals the report stresses the importance of remaining alert to new threats. Leadership should address cyber threats and risks as a core business issue, and put in place a dynamic decision process that enables quick preventative action, it explains. Organisations should also have a comprehensive, yet targeted, awareness of the wider threat landscape and how it relates to them, the report adds. They should invest in cyber threat intelligence. It also urges organisations to better understand their 'crown jewels'. There should be a common understanding across the organisation of the assets that are of greatest value to the business, and how they can be prioritised and protected, it advises. Organisations should regularly test their cyber risk management capabilities, it continues, adding that cybersecurity forensics is a critical piece of the puzzle. Organisations are also advised to closely study data from incidents and attacks, maintain and explore new collaborative relationships and refresh their strategy regularly. Ken Allan, EY's Global Information Security Leader, said that organisations need to look beyond internal threats, taking into account their business ecosystem and how relationships with third parties and vendors can impact their security posture. "It's only by reaching an advanced stage of cybersecurity readiness that an organisation can start to reap the real benefits of its cybersecurity investments. By putting the building blocks in place and ensuring that the programme is able to adapt to change, companies can start to get ahead of cybercrime, adding capabilities before they are needed and preparing for threats before they arise," he said. The survey also reveals that respondents view careless or unaware employees as their top vulnerability when it comes to cyber risk, while the top threat is theft of financial information. The 2014 EY Global Information Security survey was conducted between June and August 2014. Respondents were from all major industries and located in over 60 countries. 39% were from Europe, Middle East, India & Africa, 26% from the Americas, 22% the Asia-Pacific and 13% from Japan. The majority of the survey responses were collected during face-to-face interviews. When this was not possible, the questionnaire was conducted online. Cyber and other areas of emerging risk will be discussed at Commercial Risk Europe’s forthcoming Risk Frontiers seminar in Stockholm. We have teamed up with SWERMA and FinnRima, the Swedish and Finnish risk management associations, for an intensive and targeted examination of such issues as well as key topics thrown up by our recent surveys of risk and insurance managers. The event, sponsored by ACE, will be held on 20 November. It is free to attend for all corporate risk and insurance managers. The main topics covered will be the state of the corporate insurance market in the Nordic region, the evolving European and Swedish regulatory landscape and the evolving risk landscape. For more details click here or contact awhite@commercialriskeurope.com

Organisations struggling to manage cyber risk finds EY survey

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Want to read this article?

Read Next

Healthcare and flexible/hybrid working most valued benefits

Global data breaches double in 2023 driven by extortion and third-party software attacks

Social inflation set to continue driving US liability rates: AM Best

Zurich appoints Adriana Scherzinger group head of captives

Marsh McLennan achieves ‘Autism Confidence’ status

Related Articles