Why many companies can't deal with simple cyber security problems
An illustration picture shows a projection of binary code on a man holding a laptop. Image: REUTERS/Kacper Pempel
Most corporate information security executives believe their teams can only handle “simple” incidents, like deactivating a lost phone or scanning a computer for a virus. This reflects a steady loss of confidence among corporate infosec pros in their ability to keep up with modern threats, according to a new global survey by ISACA, a non-profit group that certifies security professionals, and the RSA Conference, a series of events by security vendor RSA.
The same survey, conducted two years ago, found that 87% of respondents were comfortable with their teams’ ability to deal with security incidents. That figure dropped to 73% in the latest survey, which polled 461 information security practitioners and managers:
The survey also revealed the types of incidents that corporate infosec executives face on a daily basis. Almost a third reported dealing with phishing attacks–attempts to trick users into divulging sensitive information with cleverly disguised messages–every day. Malicious code and hacking are the other two problems that security pros grapple with daily.
Things aren’t looking up for the people charged with keeping corporate systems safe. There’s a skills gap in the infosec space, with most survey respondents saying it takes between three and six months to fill a vacancy. And even when a hire is made, respondents most frequently said that less than a quarter of those are actually qualified for the job. Companies generally provide on-the-job training to hires to get them up to speed, according to the survey.
Understaffed, underqualified, and overwhelmed security departments aren’t feeling optimistic about their ability to keep up with new technologies, and the threats these bring. A majority of respondents saw artificial intelligence posing a risk to corporate security. They were also concerned about the growth of the Internet of Things, which expands the “attack surface” available to hackers.
But Ron Hale, ISACA’s chief knowledge officer, says security managers shouldn’t be so glum. “When there’s a risk there’s a reward,” he told Quartz. “We can use AI to identify where hackers are; we can identify what incidents are occurring in a system. We can start using these systems to our benefit, rather than just relying on human judgment.”
Don't miss any update on this topic
Create a free account and access your personalized content collection with our latest publications and analyses.
License and Republishing
World Economic Forum articles may be republished in accordance with the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Public License, and in accordance with our Terms of Use.
The views expressed in this article are those of the author alone and not the World Economic Forum.
Stay up to date:
The Digital Economy
Related topics:
The Agenda Weekly
A weekly update of the most important issues driving the global agenda
You can unsubscribe at any time using the link in our emails. For more details, review our privacy policy.
More on CybersecuritySee all
Filipe Beato and Jamie Saunders
November 21, 2024