Governance of Enterprise Security: CyLab 2012 Report How ... - RSA

More documents

Recommendations

Info

About Forbes About Forbes Forbes Media encompasses Forbes and Forbes.com (www.forbes.com), the leading business site on the Web that reaches on average Forbes 30 million Media people encompasses monthly. The Forbes company and Forbes.com publishes Forbes, Forbes Asia and Forbes Europe, which together (www.forbes.com), reach a worldwide audience of more than six million the leading readers. business It also site publishes on the ForbesLife Web that reaches magazine, on average in addition 30 million to people licensee monthly. editions The in Africa, company Argentina, publishes Bulgaria, Forbes, China, Forbes Croatia, Asia and Czech Forbes Republic, Europe, Estonia, which together Georgia, India, reach a Indonesia, worldwide Israel, audience Kazakhstan, of more than Korea, six Latvia, million Middle readers. East, It also Poland, publishes Romania, ForbesLife Russia, magazine, Slovakia, in Turkey, addition and Ukraine. to licensee editions in Africa, Argentina, Bulgaria, China, Croatia, Czech Republic, Estonia, Georgia, India, Indonesia, Israel, Kazakhstan, Korea, Latvia, Middle East, Poland, Romania, Russia, Slovakia, Turkey, and Other Ukraine. Forbes Media Web sites are: ForbesWoman.com http://ForbesWoman.com Other Forbes Media Web sites are: RealClearPolitics.com http://RealClearPolitics.com ForbesWoman.com http://ForbesWoman.com RealClearMarkets.com http://RealClearMarkets.com RealClearPolitics.com http://RealClearPolitics.com RealClearSports.com http://RealClearSports.com RealClearMarkets.com http://RealClearMarkets.com RealClearWorld.com http://RealClearWorld.com. RealClearSports.com http://RealClearSports.com Together with Forbes.com, http://Forbes.com, these sites reach on average 36 million business decision makers RealClearWorld.com each month. http://RealClearWorld.com. Steve Together Forbes with serves Forbes.com, as Chairman http://Forbes.com, and Editor in Chief. these sites Mike reach Perlis on is average President 36 and million Chief business Executive decision Officer. makers Lewis D’Vorkin each month. is Chief Product Officer. Meredith Kopit Levien is Chief Revenue Officer. Steve Forbes serves as Chairman and Editor in Chief. Mike Perlis is President and Chief Executive Officer. Lewis D’Vorkin is Chief Product Officer. Meredith Kopit Levien is Chief Revenue Officer. Carnegie Mellon CyLab ! Carnegie Mellon CyLab ! @! @!
Executive Executive Summary Summary Executive Summary It has long been recognized recognized that that directors directors and officers officers have have a a fiduciary fiduciary duty duty to to protect protect the the assets assets It of has their long organizations. been recognized Today, that this directors duty duty extends extends and to digital officers digital assets, assets, have a and and fiduciary has has been been duty expanded expanded to protect by by the laws laws assets and and regulations of regulations their organizations. that that impose impose Today, specific specific this privacy privacy duty and and extends cyber to digital security cybersecurity assets, obligations and obligations has on been companies. on expanded companies. by laws and regulations that impose specific privacy and cyber This security This is is the the obligations third third biennial biennial on companies. survey survey that that Carnegie Carnegie Mellon CyLab has conducted on how boards boards of directors This directors is the and third senior biennial management management survey that are are Carnegie governing governing the security security Mellon CyLab of of their their has organizations’ organizations’ conducted on information, information, how boards of applications, applications, directors and and senior networks networks management (digital (digital are assets). governing First First the conducted conducted security of their in in 2008 2008 organizations’ and and carried forward information, in in 2010 and applications, 2012, 2012, the the surveys surveys and networks are are intended intended (digital to to measure measure assets). the the First extent extent to to which which cyber cyber governance governance is is improving. improving. The The 2012 2012 conducted survey is the in first 2008 global and carried governance forward survey, in 2010 comparing and responses from industry sectors and geographical geographical regions. 2012, regions. the surveys are intended to measure the extent to which cyber governance is improving. The 2012 survey is the first global governance survey, comparing responses from industry sectors and geographical regions. The The CyLab CyLab 2012 2012 survey survey is is based based upon upon results results received received from 108 108 57% 57% of respondents are are not not respondents respondents at the the board board or senior senior executive executive level from from Forbes Forbes analyzing the adequacy of of Global The Global CyLab 2000 2000 2012 companies. companies. survey is Half Half based of of upon the the respondents respondents results received are board board from 108 57% of respondents are not cyber insurance coverage or members, respondents members, and and at the the other other board half half or senior are non-director non-director executive level senior senior from executives. executives. Forbes analyzing the adequacy of Twenty-four Twenty-four Global 2000 companies. percent percent (24%) (24%) Half of of of the the the respondents respondents are are are board board board chairs chairs and and undertaking or undertaking key key activities cyber insurance coverage 44% 44% members, are are on on and board board the other Audit, Audit, half Governance, Governance, are non-director or Risk Risk senior Committees. Committees. executives. SeventySeventy- related activities to cyber related risk to cyber fivefive Twenty-four percent percent (75%) (75%) percent of of (24%) the the respondents respondents of the respondents are are from are critical critical board infrastructure infrastructure chairs and or undertaking key management risk management to help to them help companies. companies. 44% are on board Audit, Governance, or Risk Committees. Seventy- activities related to cyber manage them manage reputational reputational and five percent (75%) of the respondents are from critical infrastructure risk management to help For companies. For the the third third time, time, the the survey survey revealed revealed that that boards boards are not not actively actively financial and financial risks associated risks with addressing addressing cyber cyber risk risk management. management. While While placing placing high high importance importance them manage reputational the associated theft of confidential with the theft and of on For on risk risk the management management third time, the generally, generally, survey revealed there there is still still that a a boards gap gap in in are understanding understanding not actively the the and financial risks proprietary confidential data and and proprietary security linkage addressing linkage between between cyber information information risk management. technology technology While (IT) (IT) placing risks risks high and and enterprise enterprise importance risk risk associated with the theft of management. on management. risk management Although Although generally, there there have have there been been is still some some a gap measureable measureable in understanding the breaches. data and security breaches. confidential and proprietary improvements linkage improvements between since since information the the 2008 2008 technology and and 2010 2010 surveys, surveys, (IT) risks boards boards and enterprise still still are are not not risk undertaking key oversight activities related management. to cyber cyber risks, Although such as there reviewing have budgets, budgets, been some security security measureable program program data and security breaches. assessments, and and top-level top-level policies; assigning improvements roles roles and and responsibilities since the 2008 and for privacy 2010 surveys, and security; security; boards and still receiving are not regular undertaking regular reports reports key on on oversight breaches breaches activities and and IT IT risks. risks. related Involvement Involvement to cyber risks, in in such these these as areas areas reviewing would would budgets, help help them them security manage manage program reputational reputational and assessments, and financial financial and risks risks top-level associated associated policies; with with the the assigning theft theft of roles confidential confidential and responsibilities and proprietary proprietary for privacy data and and security security; breaches and receiving of personal regular personal reports information. information. on breaches and IT risks. Involvement in these areas would help them manage reputational and financial risks associated with the theft of confidential and proprietary data and security breaches of Improvements personal Improvements information. are are largely largely organizational. There has been a a noticeable noticeable increase increase in the the number of of boards boards with with Risk Committees responsible for for privacy privacy and and security security risks risks (48% in in 2012 2012 compared compared with with 8% 8% in in 2008) 2008) and and in the Improvements the number number of of companies companies are largely organizational. that that have have established established There cross-organizational cross-organizational has been a noticeable teams teams increase to to manage manage in the number privacy privacy and and of boards security security with risks Risk risks Committees (72% in 2012 responsible compared compared for with with privacy 17% 17% in and 2008). 2008). security Boards risks and (48% senior in 2012 management management compared are are with lagging, lagging, 8% in however, however, 2008) and in in the number of companies that have established cross-organizational teams to manage privacy and security Carnegie Carnegie Mellon Mellon CyLab CyLab risks (72% in 2012 compared with 17% in 2008). Boards and senior management are lagging, however, in E! ! ! Carnegie Mellon CyLab ! E!
Page 1 and 2: How Boards & Senior Executives Are
Page 3 and 4: Table of Contents Table of Contents
Page 5 and 6: About Carnegie Mellon CyLab About C
Page 7: About RSA About RSA Founded in 1982
Page 11 and 12: Committee, but indicated that when
Page 13 and 14: Carnegie Mellon University’s Dean
Page 15 and 16: Enterprise governance and IT govern
Page 17 and 18: II. Findings and Conclusions II. Fi
Page 19 and 20: Industry & Region Comparison Table:
Page 21 and 22: management regarding privacy and se
Page 23 and 24: esponsible for risk 65% of the time
Page 29 and 30: Regional Regional Conclusions Carne
Page 31 and 32: Endnotes !!!!!!!!!!!!!!!!!!!!!!!!!!

Governance of Enterprise Security: CyLab 2012 Report How ... - RSA

Create successful ePaper yourself

Delete template?

Save as template?