One third of global business decision makers report that their organisation would try to cut costs by considering paying a ransom demand from a hacker rather than invest in information security. In the UK, this figure drops to a fifth (21%) of respondents.
The findings from the 2018 Risk:Value Report, commissioned by NTT Security, the specialised security company of NTT Group, show that another 30% in the UK are not sure if they would pay or not, suggesting that only around half are prepared to invest in security to proactively protect the business.
Examining business attitudes to risk and the value of information security, NTT Security’s annual Risk:Value Report surveys C-level executives and other decision makers from non-IT functions in 12 countries across Europe, the US and APAC and from multiple industry sectors.
The findings are particularly concerning, given the growth in ransomware, as identified in NTT Security’s Global Threat Intelligence Report (GTIR) published in April. According to the GTIR, ransomware attacks surged by 350% in 2017, accounting for 29% of all attacks in EMEA and 7% of malware attacks worldwide.
Confidence levels unrealistic
Levels of confidence about being vulnerable to attack also seem unrealistic, according to the report. 41% of respondents in the UK claim that their organisation has not been affected by a data breach, compared to 47% globally. More realistically, of those in the UK, 10% expect to suffer a breach, but nearly a third (31%) do not expect to suffer a breach at all. More worrying is the 22% of UK respondents who are not sure if they have suffered a breach or not.
Given that just 4% of respondents in the UK see poor information security as the single greatest risk to the business, this is unsurprising. Notably, 14% regard Brexit as the single greatest business risk, although competitors taking market share (24%) and budget cuts (18%) top the table.
Business impact and estimated costs of a breach
When considering the impact of a breach, UK respondents are most concerned about what a data breach will do to their image, with almost three-quarters (73%) concerned about loss of customer confidence and damage to reputation (69%). The highest figures for any country.
The estimated loss in terms of revenue is 9.72% (compared to 10.29% globally, up from 2017’s 9.95%). Executives in Europe are more optimistic, expecting lower revenue losses than those in the US or APAC.
The estimated cost of recovery globally, on average, has increased to $1.52m (€1.30m), up from $1.35m (€1.15) in 2017, although UK estimates are lower at $1.33m (€1.14) this year. Globally, respondents anticipate it would take 57 days to recover from a breach, down from 74 days in 2017. However, in the UK, decision makers are more optimistic believing it would take just 47 days to recover, one of the lowest estimates for any country.
Kai Grunwitz, senior VP EMEA, NTT Security, comments: “We’re seeing almost unprecedented levels of confidence among our respondents to this year’s report, with almost half claiming they have never experienced a data breach. Some might call it naivety and perhaps suggests that many decision makers within organisations are simply not close enough to the action and are looking at one of the most serious issues within business today with an idealistic rather than realistic view.
“This is reinforced by that worrying statistic that more than a third globally would rather pay a ransom demand than invest in their cybersecurity, especially given the big hike in ransomware detections and headline-grabbing incidents like WannaCry.
While it’s encouraging that many organisations are prepared to take a long-term, proactive stance, there are still signs that many are still prepared to take a short-term, reactive approach to security in order to drive down costs.”
Whose responsibility is security anyway?
According to Risk:Value, there is no clear consensus on who is responsible for day to day security, with 19% of UK respondents saying the CIO is responsible, compared to 21% for the CEO, 18% for the CISO and 17% for the IT director. Global figures are very similar.
One area of concern, however, is whether there are regular boardroom discussions about security, with 84% of UK respondents agreeing that preventing a security attack should be a regular item on the Board’s agenda. Yet only around half (53%) admit it is and a quarter don’t know.
How prepared are organisations?
UK respondents estimate that the operations department spent noticeably more of its budget on security (17.02%) than the IT department did (12.94%). This compares to the global figures of 17.84% (operations) and 14.32% (IT), on average.
Each year the NTT Security Risk:Value report shows that companies are still failing when it comes to communicating information security policies. An impressive 77% in the UK (compared to 57% globally) claim to have a policy in place, while 10% (26% globally) are working on one. While 85% of UK respondents with a policy in place say this is actively communicated internally, less than a third (30%) admit that employees are fully aware of it.
In terms of incident response planning, the UK is the most well prepared with 63% of respondents saying their organisation has already implemented a response plan, well above the global figure of 49% , while 18% are in the process. Just 1% in the UK say they have no plans to implement an incident response plan.
“The UK is leading the pack when it comes to planning for a security breach or for non-compliance of information/data security regulations,” adds Kai Grunwitz. “Given that the GDPR has just come into force, this is encouraging. However, while the majority claim their information security and response plans are well communicated internally, it seems it’s only a minority who are ‘fully aware’ of them. This continues to be an area that businesses are failing on time and time again and needs to be addressed as a priority.”
For further information on NTT Security’s 2018 Risk:Value report and to download a copy click here.
Comment on this article below or via Twitter: @VanillaPlus OR @jcvplus
