Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
Governance of Enterprise Security: CyLab 2012 Report How ... - RSA
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Organizations are showing significant gains in cross-organizational communication.<br />
One Organizations <strong>of</strong> the most are significant showing improvements significant gains from in the cross-organizational 2008 and 2010 <strong>Governance</strong> communication. Surveys is in the<br />
establishment One <strong>of</strong> the most <strong>of</strong> internal significant cross-organizational improvements from groups the 2008 for communicating and 2010 <strong>Governance</strong> about privacy Surveys and is in security the issues.<br />
In establishment 2008, only 17% <strong>of</strong> internal <strong>of</strong> the cross-organizational respondents indicated groups that their for communicating organizations had about a cross-organizational privacy and security team; issues. in<br />
2010, In 2008, 65% only <strong>of</strong> 17% the organizations <strong>of</strong> the respondents did; and indicated in <strong>2012</strong>, that 72% their <strong>of</strong> the organizations respondents had indicated a cross-organizational that such a committee team; in had<br />
2010, been established. 65% <strong>of</strong> the organizations This is very encouraging did; and in <strong>2012</strong>, and indicates 72% <strong>of</strong> that the respondents companies are indicated learning that that such cross-organizational<br />
a committee had<br />
communication been established. is This essential is very to addressing encouraging insider and indicates threats, combating that companies external are learning attacks, closing that cross-organizational<br />
governance gaps,<br />
and communication reducing legal is essential liability. to addressing insider threats, combating external attacks, closing governance gaps,<br />
and reducing legal liability.<br />
Industry & Region Comparison Table: Cross-Organizational Committees<br />
Industry & Region Comparison Table: Cross-Organizational Committees<br />
Organizations with cross- North Europe Asia Energy / Financial IT / Industrials<br />
Organizational committee America<br />
Utilities<br />
Telecom<br />
Organizations with cross- North Europe Asia Energy / Financial IT / Industrials<br />
72% 72% 71% 50% 86% 92% 50%<br />
Organizational committee America<br />
Utilities<br />
Telecom<br />
72% 72% 71% 50% 86% 92% 50%<br />
The benefit <strong>of</strong> cross-organizational committees is realized across the globe; all geographic regions indicated<br />
that The 71% benefit or <strong>of</strong> more cross-organizational organizations have committees a cross-organizational is realized across team. the It globe; is a different all geographic story within regions industry indicated<br />
sectors, that 71% however. or more organizations The energy/utilities have a and cross-organizational industrials sectors team. each indicated It is a different that only story 50% within <strong>of</strong> the industry<br />
organizations sectors, however. have The such energy/utilities teams. and industrials sectors each indicated that only 50% <strong>of</strong> the<br />
organizations have such teams.<br />
CONCLUSIONS<br />
CONCLUSIONS<br />
The following conclusions can be drawn from the findings <strong>of</strong> the <strong>2012</strong> <strong>CyLab</strong> <strong>Governance</strong> Survey:<br />
The following conclusions can be drawn from the findings <strong>of</strong> the <strong>2012</strong> <strong>CyLab</strong> <strong>Governance</strong> Survey:<br />
! Boards are actively addressing risk management, but there is still a gap in understanding the linkage<br />
! between Boards are cybersecurity actively addressing risks and risk enterprise management, risk management. but there is still a gap in understanding the linkage<br />
! Boards between are cybersecurity not undertaking risks and key governance enterprise risk activities management. that would help protect their organizations<br />
! from Boards some are not <strong>of</strong> the undertaking highest risks: key the governance reputational activities and financial that would losses help flowing protect from their theft organizations <strong>of</strong><br />
confidential from some <strong>of</strong> and the proprietary highest risks: data the or reputational security breaches and financial involving losses personally flowing identifiable from theft information. <strong>of</strong><br />
! Organizationally, confidential and proprietary improvements data are or security seen in (1) breaches the increased involving number personally <strong>of</strong> boards identifiable with Risk information.<br />
! Committees Organizationally, responsible improvements for privacy are and seen security in (1) the risks, increased and (2) number the high <strong>of</strong> percentage boards with <strong>of</strong> Risk companies that<br />
Committees have established responsible cross-organizational for privacy and committees security risks, to focus and on (2) privacy the high and percentage security risks. <strong>of</strong> companies that<br />
! Although have established most boards cross-organizational hire outside expertise, committees less to than focus half on hire privacy it for assistance and security with risks. risk assessments<br />
! and Although risk management. most boards There hire outside is a higher expertise, reliance less upon than IT half security hire it for experts assistance than risk with services risk assessments firms.<br />
! and The risk majority management. <strong>of</strong> boards There are not is evaluating a higher reliance the adequacy upon IT <strong>of</strong> security their organizations’ experts than insurance risk services coverage firms. for<br />
! cyber The majority risks. <strong>of</strong> boards are not evaluating the adequacy <strong>of</strong> their organizations’ insurance coverage for<br />
! Boards cyber risks. are recognizing that IT security and risk expertise are important skills when recruiting board<br />
! members. Boards are recognizing that IT security and risk expertise are important skills when recruiting board<br />
! members. Less than two-thirds <strong>of</strong> the Forbes Global 2000 companies responding to the survey have full-time<br />
! personnel Less than two-thirds in key roles <strong>of</strong> responsible the Forbes for Global privacy 2000 and companies security in responding a manner that to the is consistent survey have with full-time<br />
internationally personnel in key accepted roles responsible best practices for privacy and standards. and security For organizations in a manner that that is do consistent have these with roles<br />
assigned, internationally there accepted is a serious best lack practices <strong>of</strong> functional and standards. separation For <strong>of</strong> organizations privacy and security that do responsibilities.<br />
have these roles<br />
! assigned, CISO/CSOs there still is a tend serious to report lack <strong>of</strong> to functional CIOs more separation than to CEOs <strong>of</strong> privacy or CFOs. and security responsibilities.<br />
Carnegie Mellon <strong>CyLab</strong><br />
Carnegie Mellon <strong>CyLab</strong><br />
!<br />
!<br />
! CISO/CSOs still tend to report to CIOs more than to CEOs or CFOs.<br />