More than one-third (36%) of global organisations still lack confidence in their ability to detect sophisticated cyber attacks, according to the annual EY’s Global Information Security Survey 2015, Creating trust in the digital world.
The survey of 1,755 organisations from 67 countries examines some of the most important cybersecurity issues facing businesses today and finds that 88% do not believe their information security structure fully meets their organisation’s needs. When it comes to IT security budgets, 69% say that their budgets should be increased by up to 50% to align their organisation’s need for protection with its managements’ tolerance for risk.
The most likely sources of cyber attacks: criminal syndicates (59%), hacktivists (54%) and state-sponsored groups (35%) retained their top rankings. However, compared with last year’s survey, respondents rated these sources as more likely: up from 53%, 46%, and 27%, respectively, in 2014.
Brice Lecoustey, Advisory Leader for the Commercial and Public sector at EY Luxembourg, said “Organisations are embracing the digital world with enthusiasm, but there must be a corresponding uptick in addressing the increasingly sophisticated cyber threats. Businesses should not overlook or underestimate the potential risks of cyber breaches. Instead, they should develop a laser-like focus on cybersecurity and make the required investments. The only way to make the digital world fully operational and sustainable is to enable organisations to protect themselves and their clients and to create trust in their brand."
“In Luxembourg, the organisations are actually taking advantage quite actively of the digital world. While doing so, new threats and vulnerabilities become relevant and shall not be overlooked by management. At the same time organisations become tired of investing in cybersecurity as the related budgets tend to be lesser or same compared to last year. This digital world requires permanent attention for cybersecurity and some may not recognise the need for doing more unless they get seriously affected by a security incident. The race is not lost though, but to be very frank it will never end.”
Vulnerabilities and threats: a shift in perceptions
The survey found that companies currently feel less vulnerable to attacks arising from unaware employees (44%) and outdated systems (34%); down from 57% and 52%, respectively, in the 2014 Global Information Security Survey (GISS). However, they feel more threatened today by phishing and malware. Forty-four percent of respondents (compared with 39% in 2014) ranked phishing as their top threat; 43% consider malware as their biggest threat versus 34% in 2014.
The survey also finds that organizations are falling short in thwarting a cyber attack:
- 54% say they lack a dedicated function that focuses on emerging technology and its impact
- 47% do not have a security operations center
- 36% do not have a threat intelligence program, while 18% do not have an identity and access management programme
More than half (57%) said that the contribution and value that the information security function provides to their organisation is compromised by the lack of skilled talent available, compared with 53% of respondents in the 2014 survey, indicating that the situation is deteriorating, rather than improving.
Olivier Maréchal, Financial Services Advisory Leader at EY Luxembourg, said “Cybersecurity is inherently a defensive capability, but organizations should not wait to become victims. Instead, they should take an ‘active defense’ stance, with advanced security operations centers that identify potential attackers and analyze, assess and neutralize threats before damage can occur. It is imperative that organizations consider cybersecurity as an enabler to build and keep customers’ trust.”
“Financial Services and Technology are two sectors converging very fast. It is impossible to be successful in finance without a robust IT. The sheer weight of Financial Services in the Luxembourg economy makes the country extremely sensitive to cyber-attacks. Smart devices, social media, cloud as well as regulatory driven developments, such as automatic exchange of information, all contribute to higher vulnerability. Defining one’s risk appetite and investing in building the right lines of defense is more than ever an imperative for all players in financial services.”
