A survey conducted by Gartner has found that only 65% of organisations currently have a cybersecurity expert – despite 95% of CIOs expecting cyberthreats to increase over the next three years.
The survey also revealed that skills challenges continue to plague organisations that undergo digitalisation, with digital security staffing shortages considered a top inhibitor to innovation.
Gartner’s 2018 CIO Agenda Survey gathered data from 3,160 CIO respondents in 98 countries and across major industries, representing approximately US$13 trillion in revenue/public sector budgets and US$277 billion in IT spending.
The survey indicates that cybersecurity remains a source of deep concern for organisations. Many cybercriminals not only operate in ways that organisations struggle to anticipate, but also demonstrate a readiness to adapt to changing environments, according to Rob McMillan, Research Director at Gartner.
“In a twisted way, many cybercriminals are digital pioneers, finding ways to leverage Big Data and web-scale techniques to stage attacks and steal data,” said McMillan. “CIOs can’t protect their organisations from everything, so they need to create a sustainable set of controls that balances their need to protect their business with their need to run it.”
A total of 35% of survey respondents indicate that their organisation has already invested in and deployed some aspect of digital security, while an additional 36% are actively experimenting or planning to implement in the short term. Gartner predicts that 60% of security budgets will be in support of detection and response capabilities by 2020.
“Taking a risk-based approach is imperative to set a target level of cybersecurity readiness,” McMillan said. “Raising budgets alone doesn’t create an improved risk posture. Security investments must be prioritised by business outcomes to ensure the right amount is spent on the right things.”
Business growth introduces new attack vectors
According to the survey, many CIOs consider growth and market share as the top-ranked business priority for 2018. Growth often means more diverse supplier networks; different ways of working, funding models and patterns of technology investing; as well as different products, services and channels to support.
“The bad news is that cybersecurity threats will affect more enterprises in more diverse ways that are difficult to anticipate,” McMillan said. “While the expectation of a more dangerous environment is hardly news to the informed CIO, these growth factors will introduce new attack vectors and new risks that they’re not accustomed to addressing.”
Continue to build bench strength
The survey revealed that 93% of CIOs at top-performing organisations say that digital business has enabled them to lead IT organisations that are adaptable and open to change. To the benefit of many security practices, this cultural openness broadens the organisation’s attitude toward new recruitment and training avenues.
“Cybersecurity is faced with a well-documented skills shortage, which is considered a top inhibitor to innovation,” McMillan said. “Finding talented, driven people to handle the organisation’s cybersecurity responsibilities is an endless function.”
According to Gartner, while most organizations have a role dedicated to cybersecurity expertise, and therefore appreciate its needs, the cybersecurity skills shortage continues. Gartner recommends that chief information security officers (CISOs) continue to build bench strength through innovative approaches to developing the security team’s capabilities.
Piers Wilson, Head of Product Management at Huntsman Security, believes organisations and enterprises must invest more in training their under-pressure security teams.
He said: “Gartner’s findings are quite shocking but captures the heart of a worldwide problem: the frequency, severity and sophistication of attacks is growing faster than organisations can keep up. By next year, ISACA predicts a global shortage of two million cybersecurity professionals, so it’s no wonder that so many organisations are radically understaffed in this area. On top of that, for those companies that do have cybersecurity teams, the incredible workload is likely to lead to burn-out, mistakes or vital warning signs being overlooked – all of which increases the likelihood of a successful attack. This emboldens attackers further – creating a vicious spiral of ever-increasing assaults.
“Technologies like automation and machine learning can help lift some of the burden but the bottom line is that companies simply have to invest more in making their security team more efficient and effective – training staff and investing in automation and analytics will be a necessary strategy. Otherwise businesses are trying to protect themselves with one, or both hands, tied behind their back.”
