Posted by Illinois, US: While attack vectors remain largely the same year over year, attack volume will increase and cybercrime may be vastly underreported, according to the State of Cybersecurity 2019 study from ISACA.
“Underreporting cybercrime—even when disclosure is legally mandated—appears to be the norm,” said Greg Touhill, Brigadier General (ret), ISACA Board Director, President – Cyxtera Federal and the first US Federal CISO.
“Half of all survey respondents believe most enterprises underreport cybercrime, even when required,” said Touhill. Only 1 in 3 organizations highly confident in their ability to detect and respond to threats, finds ISACA’s report.
Equally concerning, only 34 percent of cybersecurity leaders have high levels of confidence in their cybersecurity team’s ability to detect and respond to cyberthreats. The highest levels of confidence are correlated with teams reporting directly into the CISO, and the lowest levels are correlated with teams reporting into the CIO. Forty-three percent of respondents say their teams report to a CISO, and 27 percent report to a CIO.
“What we can conclude from this year’s study is that governance dictates confidence level in cybersecurity,” said Frank Downs, ISACA’s Director of Cybersecurity Practices.
These findings indicate confusion around structuring cybersecurity with information technology (IT).
ISACA’s State of Cybersecurity Study, sponsored by HCL, captures perspectives of more than 1,500 individuals who define the field worldwide.
The top three threat actors according to this report remain cybercriminals, hackers and non-malicious insiders. Phishing, malware and social engineering are the most prevalent attack types for the third year in a row. Ransomware decreased significantly; 37 percent of organizations reported experiencing ransomware in last year’s study, compared to 20 percent this year.
Less than half of organizations report an increase in cybersecurity attacks in 2019, and 79 percent consider it likely they will experience a cyberattack next year.
“Cybersecurity suffers from a siloed and static approach,” said Renju Varghese, Fellow & Chief Architect, CyberSecurity & GRC – HCL Technologies Ltd.
“Many teams are missing significant attacks because they don’t have the size or expertise to keep up with attackers. Moreover, their existing security tools and processes are segregated and seldom work in tandem,” added Varghese.
However, by carefully analyzing variables contributing to incident susceptibility and team inefficiency—including cyber reporting structure, prevalent attack methods and team readiness through a culture of continuing professional education—organizations can better prepare themselves for dangers presented by cyber miscreants, added Downs.