Tripwire, Inc, the US-based provider of IT threat, security and compliance software, has announced the results of a study sponsored by the firm on cyber literacy challenges faced by organisations. The study, in May 2015, evaluated the attitudes of executives as they relate to cybersecurity risk decision-making and communication between IT security people, executive teams and boards. Study respondents included 101 C-level executives and directors as well as 176 IT professionals from both private and public UK bodies.
Despite the increasing number of successful cyberattacks against UK organisations, the study found that 54 percent of C-level executives at businesses in the Financial Times Stock Exchange (FTSE) 100 index believe their board is both cybersecurity literate and actively engaged in routine security. IT professionals from the same organisations are less confident in their boards cybersecurity knowledge, with 26 percent stating their boards only steps in when there is a serious incident.
While the results of the Tripwire study point to executive confidence, they reveal the uncertainty of IT professionals. When asked if their board was “cyber literate,” almost one-third of IT professionals either answered “no” or “not sure.” However, when C-level executives were asked the same question, 84 percent answered “yes.”
Dwayne Melancon, chief technology officer for Tripwire, said: “There’s a big difference between cybersecurity awareness and cybersecurity literacy. “If the vast majority of executives and boards were really literate about cybersecurity risks, then spear phishing wouldn’t work. I think these results are indicative of the growing awareness that the risks connected with cybersecurity are business critical, but it would appear the executives either don’t understand how much they have to learn about cybersecurity, or they don’t want to admit that they that they don’t fully understand the business impact of these risks.”
Other findings include:
28 percent of IT professionals “don’t have visibility” into what the board is told about cybersecurity, and 47 percent were “not concerned” about their boards knowledge of cybersecurity.
In the event of a cyberattack, respondents would be most concerned about customer data (62 percent), damage to brand and reputation (50 percent), and financial damage or stock price (40 percent).
35 percent of respondents agreed that a security breach at their own organization had the biggest impact on their boards’ cybersecurity awareness, while other respondents felt that Heartbleed (19 percent) had a bigger impact than the Target or Sony breach and the Snowden leaks (17 percent and 8 percent, respectively).
Melancon said: “Most organisations are not struggling with communication tools. They are instead struggling with finding the right vocabulary and information to accurately portray cybersecurity risk to their boards, and they are trying to find the right balance of responsibility and oversight for this critical business risk.”
