by Steve Havert (Independent IT Consultant with thirty-six year IT career working in every facet of IT).
According to a recent survey of 600 IT security decision makers it was found that :
The question that these results raise is: why the inverse relationship between perceived risk and confidence in being able to mitigate the risk? Let's examine some of the reasons why this is the case.
One possible reason that an IT security manager may not feel confident is that they have experienced an attack which caused significant damage – either in terms of lost data, lost productivity, direct financial loss or some combination of those. The fact that their security measures did not successfully deter the attack could well make them feel less confident.
Interestingly, of the 53% of the respondents who indicated that they had experienced an email hack or breach
Presumably they learned a great deal from the attack and applied the lessons learned by implementing changes in policies, procedures, technology, etc.
The analysis of the data from the survey grouped the respondents into five personas (categories): Apprehensive, Nervous, Battle-scarred, Vigilant and Equipped Veteran. The Apprehensive persona represents the respondents who felt least equipped while the Equipped Veteran persona represents the most confident group. Three attributes of these persona correlate with the degree of confidence: organization size, C-suite involvement and security spending as a percentage of overall IT budget.
While organization size was not a perfect correlation, for the most part the confident IT security managers worked for larger corporations. The two least confident groups, Apprehensive and Nervous, tended to work in companies with less than 450 employees.
The two most confident groups, Vigilant and Equipped Veteran, tended to work in companies with more than 800 employees. My fifteen years’ experience providing IT consulting services supports this finding. The vast majority of my small business clients were ill-equipped to prevent or deal with an email cyber-attack prior to my working with them. Many of them had a home network type router/firewall, no anti-virus or only anti-virus programs that they could get for free, no spam filtering service or software, an inadequate or no backup system and no company policies regarding email security.
Their backgrounds tend to be in sales, operations management, finance or marketing. Therefore, they have had little exposure to IT issues other than as a hardware and software user. Unless their company has experienced a serious IT security breach or they have experienced one personally, they tend to discount the threat posed by malicious emails.
The C-suite individuals I’ve worked with who had a personal experience with malware (often due to opening an infected email on their home computer) or their personal email account being hacked (because their password was something obvious or easy to crack – e.g. “password”) were the only ones that emphasized the importance of IT security as a need when requesting consulting services.
When the C-suite doesn’t acknowledge the critical importance of email security, the portion of the IT budget allocated to it reflects this bias. They understand the need for
These items increase productivity, are necessary for company growth and represent an investment in the company’s future; the executive gets it. If they have not experienced a security breach as a result of an email, the executive may have difficulty comprehending spending money to avoid something that may not happen.
Even when it does happen, some executives see it as an isolated incident (especially when the impact is small). They don’t understand that their company’s IT infrastructure is constantly being bombarded by infected emails, spoof emails, spam, etc. The “isolated incident” isn’t isolated, it represents the small crack in the dam which allows a drop or two of water to leak through but is really the beginning of the dam’s eventual failure.
Being “Apprehensive” or “Nervous” about your company’s preparedness for an email threat is not necessarily a bad thing. In fact, it seems a very appropriate attitude given the likelihood of a successful attack and the disaster potential of that attack. (Anyone who has experienced a successful CryptoWall attack knows how disastrous one can be. The latest version seems to be even more diabolical than previous versions – in some cases encrypting data just prior to being backed up and then decrypting it after the backup, resulting in encrypted data in the backups going back several weeks or months.)
Those feelings of apprehension and nervousness can and should become the motivation for implementing the measures that will increase the security of the organization’s email. Whether the problem is lack of C-suite engagement or lack of budget allocated to email security, the IT security manager/director/VP is responsible for ensuring the security and integrity of the organization’s data and electronic communications. In this role, they may need to become salesmen, preachers, even zealots, in convincing executive management of the critical need to fully fund email security measures.
In addition to funding for security technology, they need to enact policies and procedures designed to educate and regulate employees so that they understand and will self-manage the threat posed by malicious emails. When, not if, an attack occurs and is successful, it will be the person responsible for IT security that will have to answer for it. I doubt that “I tried to warn you” will be considered an acceptable excuse by senior management if that warning wasn’t compelling, loud and continuous.
C-suite must acknowledge the critical importance of email security. When, not if, an attack occurs and is successful, it will be the person responsible for IT security that will have to answer for it. The “isolated incident” isn’t isolated, it represents the small crack in the dam.
Whether the problem is lack of C-suite engagement or lack of budget allocated to email security, the IT security manager/director/VP is responsible for ensuring the security and integrity of the organization’s data and electronic communications. In this role, they may need to become salesmen, preachers, even zealots, in convincing executive management of the critical need to fully fund email security measures.
About Steve -Steve Havert is an independent IT Consultant based in Seattle, WA. He has spent his thirty-six year IT career working in every facet of IT for large corporations as well as his own IT consulting business in Orange County, CA. He continues to work as a freelance consultant while pursuing a second career in photography. * Survey referenced was completed by Mimecast in February of this year.
Cybercriminals are exploiting Microsoft Teams for phishing attacks. Learn how to identify threats, enhance security, and protect your organization from these scams.
Deepfakes pose a growing cybersecurity risk for businesses. Learn how MSPs can protect clients from AI-driven fraud and social engineering threats.
TrickBot is a trojan malware that was originally designed to target bank users. Recently, TrickBot has been associated with the distribution of ransomware in order to facilitate infection.
Sign-up for email updates...
