Despite the overall growth in cyberattacks, only one-third of organisations say the cybersecurity function is involved at the planning stage of a new business initiative, according to the EY Global Information Security Survey (GISS).
This year’s GISS, which surveyed almost 1,300 cybersecurity leaders at organisations worldwide, showed that almost 60% of them have faced an increased number of disruptive attacks in the past 12 months.
In addition, over the last year, activists were responsible for 21% of successful cyber attacks – second only to organized crime groups (23%) – compared with last year’s study, where just 12% of respondents considered activists as the most likely source of an attack, EY noted.
Despite the increasing risk, only 36% of new, technology-enabled business initiatives include the security team from the beginning, EY pointed out.
Cybersecurity has traditionally been a compliance activity, bolted on by a checklist approach instead of built into every technology-enabled business initiative, said Kris Lovejoy, EY Global Cybersecurity Leader, Advisory.
“However, that is not a sustainable model. If we ever hope to get ahead of the threat, we must focus on creating a culture of security by design,” she noted. “This can only be accomplished if we successfully bridge the divide between the security function and the C-suite and enable the chief information security officer (CISO) to act as a consultant and enabler instead of the stereotypical roadblock.”
The disconnect
According to the survey, while cybersecurity teams generally have good relations with adjacent functions such as IT, audit, risk and legal, there is a disconnect with other parts of the business.
Almost three-quarters (74%) say that the relationship between cybersecurity and marketing is, at best, neutral, if not mistrustful or non-existent, while 64% say the same of the research and development team and 59% for the lines of business.
More than half (57%) say their relationship with finance, on which they depend on for budget authorisation, is also strained.
As companies undergo transformation, what’s needed is to build relationships of trust across every function of the organization, starting at the board level so that cybersecurity is established as a key value enabler, Lovejoy said.
“Boards, senior management teams, CISOs and leaders throughout the business must collaborate to position cybersecurity at the heart of business transformation and innovation,” she advised.
