Survey: Cybersecurity requires risk-based management approach
We’ve entered a new era of cyber risk where cybersecurity is no longer just an IT issue, according to findings from a May 2022 ThoughtLab global survey co-sponsored by ServiceNow. Although cyberattacks and breaches are increasing, many organizations are unprepared to respond.
The problems come down to three main areas:
- Extended attack surface through partners and suppliers
- Cyber risk initiatives not up to date with digital transformation
- Budget constraints
Denial of service and phishing attacks account for the lion’s share of cyberthreats today, at 49% and 46% of attacks, respectively. In the next two years, phishing attacks will continue to be a problem, posing the highest risk for 50% of the 1,200 worldwide organizations surveyed across 14 industries. But denial of service will be less of a threat (31%) in the subsequent 24 months, surpassed by human error (44%) and ransomware (40%).
The cybersecurity landscape
To counter these attacks, organizations should harden their systems to prevent cybercriminals from ever breaching them. This requires detailed attention to IT infrastructure and platforms. Although human error is the main cause of today’s largest breaches, misconfigurations will pose the biggest risk over the the next two years, according to the survey.
“Misconfigurations across applications, systems, platforms, and servers—and neglecting to put new default settings in place—can create dangerous pathways for hackers,” the report notes.
Organizations know they need stronger security, but budget constraints prevent them from investing in cybersecurity technologies. Businesses also struggle with identifying key risks and detecting and responding to incidents.
Despite these challenges, many organizations have succeeded in establishing governance and risk assessment. And more than half of the respondents surveyed have invested in protective technology (55%) and data security (52%). Where organizations come up short is in awareness and training. Investments in this area could help curb breaches due to human error.
Bolstering security
Nearly 60% of organizations have successfully implemented cyberthreat detection processes. Yet, it takes an average 128 days to detect a breach, according to the study. To ramp up security initiatives, organizations need to move from the detection phase to continuous monitoring.
Beyond that, the best way forward is through a risk-based approach involving:
- Regular risk assessment
- Advanced analysis
- Enterprise-wide risk management
- Proactive risk mitigation
"Risk-based management aligns security priorities with the business and helps security leaders become more strategic in their views and outcomes,” explains Barbara Kay, senior director of product marketing, risk, security, and ESG at ServiceNow.
Nearly half (43%) of surveyed organizations have adopted a risk-based approach to date.