U.S. Businesses Lead the Pack in Cyber Security Readiness

February 12, 2014

Four in 10 (41 percent) US business leaders consider cyber security as a major priority, compared just 20 percent in Europe and 30 percent globally, research from BT has revealed.

The research, which assessed attitudes to cyber security and levels of preparedness among IT decision makers, highlights that European businesses are lagging behind their US counterparts in crucial areas. In the US 90 percent of organizations are able to measure the return on investment (ROI) of cyber security measures, compared to just over half in Europe (58 percent). Similarly, 86 percent of US directors and senior decision makers say they are given IT security training, compared to just 44 percent in Europe.

Globally, more than half (58 percent) of IT decision-makers stated that their boards underestimate the importance of cyber security. This figure increases to 74 percent in the US but drops to 50 percent in Europe.

The difference in levels of preparedness correlates with attitudes to threats. Non-malicious insider threats (e.g. accidental loss of data) are the most commonly cited security concern globally, being reported as a serious threat by 65 percent of IT decision makers. In Europe this figure falls to 56 percent and is followed by malicious insider threats (53 percent), hacktivism (48 percent), organized crime (38 percent) and nation states (31 percent).

In the US, the proportion of IT decision makers who see non-malicious insider threats as a severe threat increases to 85 percent and is followed by malicious insider threats (79 percent), hacktivism (77 percent), organized crime (75 percent), terrorism (72 percent) and nation states (70 percent).

Globally, over half of IT decision makers believe that hacktivism (54 percent) and malicious insider threats (53 percent) will pose a greater risk over the next 12 months.In the US this increases to 73 percent and 74 percent respectively, compared to 39 percent and 38 percent in Europe. Globally, terrorism is seen as the threat least likely to pose more risk over the next 12 months.

Mark Hughes, CEO of BT Security, said: “The research provides a fascinating insight into the changing threat landscape and the challenge this poses for organizations globally. The massive expansion of employee-owned devices, cloud computing and extranets, have multiplied the risk of abuse and attack, leaving organizations exposed to a myriad of internal and external threats – malicious and accidental.

“US businesses should be celebrated for putting cyber security on the front foot. The risks to business are moving too fast for a purely reactive security approach to be successful. Nor should cyber security be seen as an issue for the IT department alone.”

In response to emerging threats, three quarters (75 percent) of IT decision makers globally say they would like to overhaul their infrastructure and design them with security features from the ground up. While 74 percent would like to train all staff in cyber security best practice. Similarly, just over half (54 percent) say they would like to engage an external vendor to monitor the system and prevent attacks.

Hughes added: “As the threat landscape continues to evolve, CEOs and board level executives need to invest in cyber security and educate their people in the IT department and beyond. The stakes are too high for cyber security to be pushed to the bottom of the pile.”

With the advent of Internet of Things (IoT) technology and Industrial Internet of Things (IIoT), the cyber security practices are increasingly getting integrated with the physical security practices.

We will provide insight on NDAA Section 889 and how the act has evolved and impacted business, so that organizations can better mitigate risk and stay compliant.