Governance of Enterprise Security: CyLab 2012 Report How ... - RSA

Organizations are showing significant gains in cross-organizational communication.
One Organizations of the most are significant showing improvements significant gains from in the cross-organizational 2008 and 2010 Governance communication. Surveys is in the
establishment One of the most of internal significant cross-organizational improvements from groups the 2008 for communicating and 2010 Governance about privacy Surveys and is in security the issues.
In establishment 2008, only 17% of internal of the cross-organizational respondents indicated groups that their for communicating organizations had about a cross-organizational privacy and security team; issues. in
2010, In 2008, 65% only of 17% the organizations of the respondents did; and indicated in 2012, that 72% their of the organizations respondents had indicated a cross-organizational that such a committee team; in had
2010, been established. 65% of the organizations This is very encouraging did; and in 2012, and indicates 72% of that the respondents companies are indicated learning that that such cross-organizational
a committee had
communication been established. is This essential is very to addressing encouraging insider and indicates threats, combating that companies external are learning attacks, closing that cross-organizational
governance gaps,
and communication reducing legal is essential liability. to addressing insider threats, combating external attacks, closing governance gaps,
and reducing legal liability.
Industry & Region Comparison Table: Cross-Organizational Committees
Industry & Region Comparison Table: Cross-Organizational Committees
Organizations with cross- North Europe Asia Energy / Financial IT / Industrials
Organizational committee America
Utilities
Telecom
Organizations with cross- North Europe Asia Energy / Financial IT / Industrials
72% 72% 71% 50% 86% 92% 50%
Organizational committee America
Utilities
Telecom
72% 72% 71% 50% 86% 92% 50%
The benefit of cross-organizational committees is realized across the globe; all geographic regions indicated
that The 71% benefit or of more cross-organizational organizations have committees a cross-organizational is realized across team. the It globe; is a different all geographic story within regions industry indicated
sectors, that 71% however. or more organizations The energy/utilities have a and cross-organizational industrials sectors team. each indicated It is a different that only story 50% within of the industry
organizations sectors, however. have The such energy/utilities teams. and industrials sectors each indicated that only 50% of the
organizations have such teams.
CONCLUSIONS
CONCLUSIONS
The following conclusions can be drawn from the findings of the 2012 CyLab Governance Survey:
The following conclusions can be drawn from the findings of the 2012 CyLab Governance Survey:
! Boards are actively addressing risk management, but there is still a gap in understanding the linkage
! between Boards are cybersecurity actively addressing risks and risk enterprise management, risk management. but there is still a gap in understanding the linkage
! Boards between are cybersecurity not undertaking risks and key governance enterprise risk activities management. that would help protect their organizations
! from Boards some are not of the undertaking highest risks: key the governance reputational activities and financial that would losses help flowing protect from their theft organizations of
confidential from some of and the proprietary highest risks: data the or reputational security breaches and financial involving losses personally flowing identifiable from theft information. of
! Organizationally, confidential and proprietary improvements data are or security seen in (1) breaches the increased involving number personally of boards identifiable with Risk information.
! Committees Organizationally, responsible improvements for privacy are and seen security in (1) the risks, increased and (2) number the high of percentage boards with of Risk companies that
Committees have established responsible cross-organizational for privacy and committees security risks, to focus and on (2) privacy the high and percentage security risks. of companies that
! Although have established most boards cross-organizational hire outside expertise, committees less to than focus half on hire privacy it for assistance and security with risks. risk assessments
! and Although risk management. most boards There hire outside is a higher expertise, reliance less upon than IT half security hire it for experts assistance than risk with services risk assessments firms.
! and The risk majority management. of boards There are not is evaluating a higher reliance the adequacy upon IT of security their organizations’ experts than insurance risk services coverage firms. for
! cyber The majority risks. of boards are not evaluating the adequacy of their organizations’ insurance coverage for
! Boards cyber risks. are recognizing that IT security and risk expertise are important skills when recruiting board
! members. Boards are recognizing that IT security and risk expertise are important skills when recruiting board
! members. Less than two-thirds of the Forbes Global 2000 companies responding to the survey have full-time
! personnel Less than two-thirds in key roles of responsible the Forbes for Global privacy 2000 and companies security in responding a manner that to the is consistent survey have with full-time
internationally personnel in key accepted roles responsible best practices for privacy and standards. and security For organizations in a manner that that is do consistent have these with roles
assigned, internationally there accepted is a serious best lack practices of functional and standards. separation For of organizations privacy and security that do responsibilities.
have these roles
! assigned, CISO/CSOs there still is a tend serious to report lack of to functional CIOs more separation than to CEOs of privacy or CFOs. and security responsibilities.
Carnegie Mellon CyLab
Carnegie Mellon CyLab
!
!
! CISO/CSOs still tend to report to CIOs more than to CEOs or CFOs.