Johannesburg, 11 Jun 2015
Story highlights:
*Nearly 75% surveyed lack the maturity to address cybersecurity risks
* 83% of large organisations ranked themselves as below "developed" in maturity
* Up to 45% admit inability to measure, assess and mitigate cybersecurity risk
* The most mature capability revealed in research is in the area of Protection, Detect and Response capabilities lag
* Only one-third of financial services organisations report being adequately prepared
* NIST Cybersecurity Framework used as the measuring stick; yet the Americas rank themselves behind both APJ and EMEA in overall maturity
Today, RSA, The Security Division of EMC (NYSE: EMC), released its inaugural Cybersecurity Poverty Index that compiled survey results from more than 400 security professionals across 61 countries. The survey allowed participants to self-assess the maturity of their cybersecurity programs leveraging the NIST Cybersecurity Framework (CSF) as the measuring stick.
The research provides valuable global insight into how organisations rate their overall cybersecurity maturity and practices across a variety of organisational sizes, industries and geographies. While larger organisations are typically thought of as having the resources to mount a more substantive cyber defence, the results of the survey indicate size is not a determinant of strong cybersecurity maturity and nearly 75% of all respondents self-reported insufficient levels of security maturity.
The lack of overall maturity is not surprising as many organisations surveyed reported security incidents that resulted in loss or damage to their operations over the past 12 months. The most mature capability revealed in the research was the area of protection. The research results provide quantitative insight that organisations' most mature area of their cybersecurity program and capabilities are in preventative solutions despite the common understanding that preventative strategies and solutions alone are insufficient in the face of more advanced attacks.
Further, the greatest weakness of the organisations surveyed was the ability to measure, assess and mitigate cybersecurity risk with 45% of those surveyed describing their capabilities in this area as "non-existent," or "ad hoc," and only 21% reporting that they are mature in this domain. This shortfall makes it difficult or impossible to prioritize security activity and investment, a foundational activity for any organisation looking to improve their security capabilities today.
Counter to expectations, the research indicates that the size of an organisation is not an indicator of maturity. In fact, 83% of organisations surveyed with more than 10 000+ employees rated their capabilities as less than "developed" in overall maturity. This result suggests that large organisations' overall experience and visibility into advanced threats dictate the need for greater maturity than their current standing. Large organisations' weak self-assessed maturity ratings indicate their understanding of the need to move to detect and response solutions and strategies for a more robust and mature security.
Also counterintuitive to expectations were the results from Financial Services organisations, a sector often cited as industry-leading in terms of security maturity. Despite conventional wisdom, however, the Financial Services organisations surveyed did not rank themselves as the most mature industry, with only one third rating as well-prepared. Critical infrastructure operators, the original target audience for the CSF, will need to make significant steps forward in their current levels of maturity. Organisations in the telecommunications industry reported the highest level of maturity with 50% of respondents having developed or advantaged capabilities, while government ranked last across industries in the survey, with only 18% of respondents ranking as developed or advantaged. The lower self-assessments of maturity in otherwise notably mature industries suggest a greater understanding of the advanced threat landscape and their need to build more mature capabilities to match it.
Despite the fact that the CSF was developed in the United States, the reported maturity of organisations in the Americas ranked behind both APJ and EMEA. Organisations in APJ reported the most mature security strategies with 39% ranked as developed or advantaged in overall maturity while only 26% of organisations in EMEA and 24% of organisations in the Americas rated as developed or advantaged.
Methodology
To assess cybersecurity maturity, respondents self-assessed their capabilities against a sampling of the NIST Cybersecurity Framework (CSF). The CSF provides guidance based on existing standards, guidelines, and practices for reducing cyber risks, and was created through collaboration between industry and government. While the CSF was initially developed in the United States with the aim of helping to reduce cyber risks to critical infrastructure, organisations worldwide have found it to be a prioritised, flexible, repeatable, and cost-effective approach for managing cyber risk. Thus, it serves as an excellent baseline to assess any organisation's core cyber security and cyber risk management maturity.
Organisations rated their own capabilities in the five key functions outlined by the CSF: identify, protect, detect, respond, and recover. Ratings used a five point scale, with one signifying that the organization had no capability in a given area, and five indicating that they had highly mature practices in the area.
Executive quotes:
Amit Yoran, President, RSA, The Security Division of EMC
"This research demonstrates that enterprises continue to pour vast amounts of money into next generation firewalls, anti-virus, and advanced malware protection in the hopes of stopping advanced threats. Despite investment in these areas, however, even the biggest organisations still feel unprepared for the threats they are facing. We believe this dichotomy is a result of the failure of today's prevention-based security models to address the advancing threat landscape. We need to change the way we think about security and that starts by acknowledging that prevention alone is a failed strategy and more attention needs to be spent on strategy based on detection and response."
Stephen T. Whitlock, Chief of Strategy & Technology, Information Security Solutions, Boeing
"Boeing has supported and contributed to the NIST Cybersecurity Framework from its inception. We use it as a basis to assess the overall security of both internal organisations and with external customers. The CSF promotes a comprehensive, adaptable, risk-based approach that is technology and regulatory neutral. As we have used the Framework, the results have had significant impact in explaining issues and setting the direction for future cyber security capability."
Additional resources:
*Download the Cybersecurity Poverty Index eBook providing valuable insights into organisations' cyber security maturity
* Take the same Cybersecurity Maturity Assessment that was used for the Cybersecurity Poverty Index to determine your own organisation's maturity
* Watch a video from Amit Yoran, Zulfikar Ramzan, and Mike Brown discussing insights from the Cybersecurity Poverty Index
* Download an infographic highlighting key research results
* Connect with RSA via Twitter, Facebook, YouTube, LinkedIn and the RSA Speaking of Security Blog and Podcast
Share