A new survey of CEOs and chief information security officers (CISOs) finds that they have vastly different perspectives and concerns regarding security threats. Security professionals and chief executives also differ in their views about how the threat of a cyber-attack can impact their company networks or overall business.
The June 12 survey, done by Research Now on behalf of CORE Security, which makes predictive cyber-security intelligence technology, found that 61.5 percent of CISOs surveyed said they were very concerned that their IT systems might be hacked, while only 15 percent of CEOs were similarly alarmed. Twenty percent of CEOs were not concerned at all about an attack, while only 4 percent of CISOs were that nonchalant. The rest of the CEOs and CISOs said they were somewhat concerned.
Another disconnect appears in how CEOs and CISOs view the threat landscape. CISOs believe that the main security vulnerability in their organizations lies with the employees themselves, citing a lack of employee education on security and a lack of employee compliance with security best practices. CEOs, on the other hand, believe their systems are vulnerable to external threats such as phishing attacks and that they believe the company has sufficient time and resources to adequately train their employees to effectively mitigate threats.
The role of employee behavior in the security realm also showed up in a similar cyber-security report done by Cisco Systems. The networking companys Connected World Technology Report revealed that seven of 10 employees surveyed admitted to knowingly breaking IT policies on a regular basis, and three of five believe they are not responsible for protecting corporate information and devices. The Cisco survey was limited to college students and young professionals and some of the questions were also related to young workers preference for bringing their own devices into the workplace, a trend called bring your own device (BYOD).
Further reading
The lack of attention to cyber-security as well as privacy protectionon the part of senior executives was also reflected in a survey released during the 2012 RSA Conference earlier this year. There, RSA released The Carnegie Mellon University CyLab 2012 Governance Survey of senior executives and directors from Forbes Global 2000 companies, which revealed that 70 percent of them "occasionally, rarely or never" review and approve top-level policies on IT security and privacy; 74 percent occasionally, rarely or never approve roles and responsibilities for lead personnel for privacy and security; and 64 percent occasionally, rarely or never approve annual budgets for privacy and security protection.
More encouraging, however, was that 38 percent in the Carnegie Mellon survey said they regularly receive reports from senior management regarding security and privacy issues, followed by 34 percent occasionally, and 25 percent rarely or never.
The CORESecurity survey concludes that CEOs and CISOs need to better understand the security threat they face and go on the offensive in order to predict and prevent threats before they occur. Instead, the majority of the $30 billion in cyber-security spending is focused on solutions that take defensive or reactive approaches to threats.
Research Assistant
