Cybersecurity Preparedness Benchmark Study_Webex 27 Ocober 2016

Cybersecurity Preparedness
Benchmark Study

2Berkeley Research Group - Cybersecurity Preparedness Benchmarking Study
National Cybersecurity Awareness
Month (NCSAM)
• This October is the 13th annual National Cyber
Security Awareness Month
• As the month comes to a close we hope you will
continue to promote a safer, more secure and
more trusted internet all year long
• BRG is a proud NCSAM Champion and we
encourage everyone to support the 6th
anniversary of STOP. THINK. CONNECT.™
NCSAM initiative
• More information can be found @
https://staysafeonline.org/

BRG Overview
Over 1,000 professionals in 37 offices

Study Background
Why the need for cybersecurity benchmarking?
• Financial and non-financial consequences of a successful cyber attack
• Governance and Technology
• Gain understanding how other peers implement Information Security
• Study results from two different points of view:
– overall results across all participants to provide a thorough and balanced
view of the current state of Cybersecurity
– an individual assessment for each participant where individual answers
are discussed and compared against other study respondents

5
Study Background
Target group: Executive Management and Board of
Directors from different sectors
Survey: 103 Questions, approximately 60 minutes.
Online questionnaire; select phone
interviews
Timeline: Q1 and Q2 2016
Results: Q3 2016
Participants received: Anonymized evaluation of participant data
including indication of their individual
answers
Berkeley Research Group - Cybersecurity Preparedness Benchmarking Study

6
Objectives

7
Country of Origin

8
Study Participants
Primary Industry of Organization Title or Level in Organization
Total Employees with Average FTE IT Employees

9
Strategic Insights

10
Who does the CISO/CSO report to?
Growing Importance
of CISO
54%
of organizations
report an
Information Security
Officer is in place

11
How would you rate your organization’s
information security culture?
Security Culture
CISO
73%
of organizations
have a formal
cybersecurity training
and awareness program

12
Rate the effectiveness of your
organization’s cyber security program
Cybersecurity Effectiveness
CISO
80%
of organizations report
that senior managers
approach information
security as an enterprise
risk-management issue

13
How would you rate your organization’s cyber
security incident response capabilities?
Incident Response Capability
CISO
60%
of organizations inform
governments and
regulators of
cybersecurity breaches

14
What strategic initiatives has your
organization adopted in its security program?
Strategic Initiatives
90%
of organizations do not
have a cybersecurity
strategy for the Internet
of Things

15
Board and Executive Leadership

16
Areas in which the Board of
Directors actively participate:
Board Engagement
CISO
55%
of organizations
report that the Board
of Directors actively
participate in overall
cybersecurity strategy

17
Areas board participation has helped improve your
organization’s information security program:
Board Influence

18
How does the board oversee cyber security-related issues?
Board Oversight

19
How would you rate the organizational leadership support for cybersecurity?
Rate senior management focus on information security
Leadership Support & Focus

20
How do you measure the effectiveness of
the organization’s cyber security program?
Feedback Mechanisms
69%
of organizations rely
on auditors, both
internal and external
as a measure of their
cybersecurity
effectiveness

21
Managing Security Risk

22
Has your organization performed a cyber risk appetite assessment?
Has your organization performed a cyber threat assessment?
Cybersecurity Risk
Assessments
CISO
CISO
47%
of organizations do
not believe that
leadership has a
functional
understanding of their
network security

Are there formal security and operational procedures documented?
23
Documented Procedures
91%
of organizations
document their
cybersecurity
policies and
procedures

24
Areas for improvement and awareness programs?
Improvement & Awareness

25
How often does executive management receive periodical briefings
on the state of your organization’s network security system?
Executive Briefings
30%
of executive
management receive
a briefing once every
six months or less

26
Systems and Controls

Which information security standard and best practice does
your organization follow?
Security Standards
37%
of organizations
used ISO27001,
with financial
services at 43%

Security controls and business continuity
plans are tested on a regular basis?
Controls Testing

How often are the security controls of the enterprise
systems and interconnected systems reviewed?
29Berkeley Research Group - Cybersecurity Preparedness Benchmark Study
System Reviews
24%
of organizations do
not routinely test
security controls
and business
continuity plans on
a regular basis

How often are self-assessments conducted?
Self-assessments
30%
of organizations
do not routinely
undertake self-
assessments
CISO

How often are external security assessments conducted?
External Assessments
CISO

What steps has your organization taken in order to obtain assurances from
external service providers and vendors that their security meets standards?
32Berkeley Research Group - Cybersecurity Preparedness Benchmark Study
External Service
Providers & VendorsCISO
63%
of organizations have
ensured external
service providers and
vendor contracts
include provisions for
security

33
Governance and Reporting

Rate your organization’s cyber security
risk management program
Risk Management Effectiveness
42%
of organizations
somewhat agree that
cybersecurity risks
are being considered
in business decision
making
7%
of organizations
strongly agree that
cybersecurity risks
are being considered
in business decision
making

Rate your organization’s cyber security
Information Governance capabilities
Information Governance
Capabilities
56%
of organizations rate
their Information
Governance
capabilities as
‘slightly’ or
‘somewhat effective’

Rate your company’s information security governance maturity level
IS Governance Maturity
CISO

Rate your company’s IT risk management maturity level
37
IT Risk Management Maturity
CISOCISO

Rate your company’s cloud computing maturity level
38
Cloud Computing Maturity
57%
of organizations do
not allow use of
public cloud services

39
Does the organization incident response
plan outline regulatory and governmental
notification protocols for breaches?
Regulatory &
Government Reporting
57%
of organizations are
required by
regulatory and
government
agencies to disclose
system breaches

40
Breaches and Incidents

What type of breaches did your organization experience?
41
Type of
Cybersecurity
Breaches
51%
of organizations do not
believe they are well
equipped to handle a
breach
46%
of organizations
report having
experienced a
cybersecurity breach

45%
of organizations
report current
employees as the
most likely source of
cybersecurity breach
incidents
42
What was the estimated source
of data breach incidents?
Sources of Breaches

Type of staff-related incidents the organization experienced?
43
Staff-related Incidents

Key Observations
Despite a strong focus on cybersecurity culture, many organizations do
not believe their cybersecurity programs are fully effective
45% of respondents reported that they needed to improve security awareness
and training
Current employees are the likely cause behind most cybersecurity
breaches
Respondents reported that current employees were the likely source of 45% of
data breach incidents, followed by 22% of incidents caused by hackers
and 13% by former employees
Viruses and malicious software are the most common breaches.
Respondents reported that infections from viruses or malicious software
accounted for 39% of all data breaches, followed by system failures or data
corruption accounting for 35% of breaches

Key Observations
Most organizations do not have strategies for the emerging fields of the
Internet of Things or Big Data
90% of respondents do not have a cybersecurity strategy for the Internet of
Things, and 86% do not have a strategy for Big Data
Organizations lack confidence in their cybersecurity incident response
capability
65% of respondents reported having a formal cyber incident response plan,
and 60% incorporated regulatory and government notification protocols for
breaches. However, when asked if their organization was well equipped to
handle a cyber breach, 51% of respondents were neutral or disagreed
Organizations anticipate an increase in information security budgets
54% of respondents reported that they expected an increase in their 2016
cybersecurity budget. However, 48% of respondents reported they were neutral
or disagreed when asked if leadership allocated adequate budget for
cybersecurity efforts

Recommendations
• Review and approve the cyber risk appetite and tolerance at board level;
• Ensure the board has sufficient cybersecurity expertise and/or access to such
expertise;
• Build cybersecurity in to all activities and develop enterprise-wide cyber risk
management strategies and procedures;
• Incorporate cybersecurity within business strategy and risk management
frameworks;
• Develop procedures to identify and manage cyber risks associated with
outside vendors, suppliers, customers, utilities, and other external
organizations and service providers;
• Undertake testing to include the potential for multiple attacks and the impact
of interruptions on critical infrastructure;
• Ensure there is a robust cyber resilience and incident response program;
• Pro-actively undertake cyber threat intelligence gathering and ongoing
security analytics;
• Invest in your people to ensure there is high awareness and ownership for
cybersecurity across the organisation.

Cybersecurity Preparedness Benchmark Study_Webex 27 Ocober 2016

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (11)

Similar to Cybersecurity Preparedness Benchmark Study_Webex 27 Ocober 2016

Similar to Cybersecurity Preparedness Benchmark Study_Webex 27 Ocober 2016 (20)

More from Tony Moroney

More from Tony Moroney (13)

Cybersecurity Preparedness Benchmark Study_Webex 27 Ocober 2016