Tripwire, Inc., the global provider of advanced threat, security and compliance solutions, today announced the results of a study on cyber literacy challenges faced by organisations. The study, which was carried out in May 2015, evaluated the attitudes of executives as they relate to cyber security risk decision-making and communication between IT security professionals, executive teams and boards. Study respondents included 101 C-level executives and directors as well as 176 IT professionals from both private and public U.K. organisations.
Despite the increasing number of successful cyber attacks against U.K. organisations, the study revealed that 54 per cent of C-level executives at organisations within the Financial Times Stock Exchange (FTSE) 100 index believe their board is both cyber security literate and actively engaged in routine security. IT professionals from the same organisations are less confident in their boards cyber security knowledge, with 26 per cent stating their boards only steps in when there is a serious incident.
While the results of the Tripwire study point to executive confidence, they reveal the uncertainty of IT professionals. When asked if their board was “cyber literate,” almost one-third of IT professionals either answered “no” or “not sure.” However, when C-level executives were asked the same question, 84 per cent answered “yes.”
“There’s a big difference between cyber security awareness and cyber security literacy,” said Dwayne Melancon, chief technology officer for Tripwire. “If the vast majority of executives and boards were really literate about cyber security risks, then spear phishing wouldn’t work. I think these results are indicative of the growing awareness that the risks connected with cyber security are business critical, but it would appear the executives either don’t understand how much they have to learn about cyber security, or they don’t want to admit that they that they don’t fully understand the business impact of these risks.”
Other key findings include:
- 28 per cent of IT professionals “don’t have visibility” into what the board is told about cyber security, and 47 per cent were “not concerned” about their boards knowledge of cyber security.
- In the event of a cyber attack, respondents would be most concerned about customer data (62 per cent), damage to brand and reputation (50 per cent), and financial damage or stock price (40 per cent).
- 35 per cent of respondents agreed that a security breach at their own organisation had the biggest impact on their boards’ cyber security awareness, while other respondents felt that Heartbleed (19 per cent) had a bigger impact than the Target or Sony breach and the Snowden leaks (17 per cent and 8 per cent, respectively).
“Most organisations are not struggling with communication tools,” said Melancon. “They are instead struggling with finding the right vocabulary and information to accurately portray cyber security risk to their boards, and they are trying to find the right balance of responsibility and oversight for this critical business risk.”