CISOs just can't keep up with flood of data breaches
More than 80 percent of CISOs reported that some detected data breaches are going unaddressed, and 70 percent said it is difficult to prioritize threats based on business criticality, according to a new survey of 300 chief information security officers from around the world conducted by ServiceNow, an IT vendor whose products and services include security.
The survey is part of a report from ServiceNow entitled “The Global CISO Study: How Leading Organizations Respond to Security Threats and Keep Data Safe.”
[Also: Symantec cites links between WannaCry ransomware and Lazurus]
Leaving data breaches unaddressed and finding it difficult to prioritize threats comes at a cost: More than one in 10 CISOs reported experiencing a significant security breach causing reputational or financial damage in the past three years, the survey said. Manual processes, resource and talent deficiencies, and the inability to prioritize threats are impairing security response effectiveness, the report said.
As a result, CISOs are increasing the automation of security tasks to bolster their response and remediation efforts, the report found.
[Also: The biggest healthcare breaches of 2017]
“CISOs are spending an increasing amount on preventing and detecting data breaches, and our research underscores that response is where they should focus,” said Sean Convery, general manager of the security business unit at ServiceNow. “Automating and orchestrating security response is the missing link for CISOs to radically increase the effectiveness of their security programs.”
The survey also found that only 19 percent of CISOs rate their organization as highly effective at preventing security breaches. Customers may suffer the most from security gaps: Only 38 percent of CISOs believe they are highly effective at protecting against breaches of customer credit card or financial information.
More than 25 percent of CISOs say manual processes and a lack of resources are barriers to their organization’s ability to detect and respond to security breaches, the survey said. And just 7 percent of CISOs say their employees have developed the skills necessary to successfully prioritize security threats.
A small group of the overall survey sample (11 percent), titled “security response leaders,” differ from the rest in that they automate a higher percentage of security activities, including more advanced tasks such as trend reporting; prioritize responses to security alerts based on business criticality; and build stronger relationships with IT and other departmental functions.
Twitter: @SiwickiHealthIT
Email the writer: bill.siwicki@himssmedia.com
