Despite 77% of companies having suffered a cyber-security incident in the past two years, more than one-third (38%) still have no incident response plan in place should an incident occur. And only 17% of businesses globally are fully prepared for an online security incident.
These are some of the findings from an Arbor Networks survey, with the Economist Intelligence Unit, “Cyber incident response: Are business leaders ready?”, which polled 360 senior business leaders, the majority of whom (73%) are C-level management or board members from across the world, with 31% based in North America, 36% in Europe and 29% in Asia-Pacific.
More prepared firms that do have a response plan in place typically rely on the IT department to lead this process, but the majority also draw upon external resources – primarily IT forensic experts, specialist legal advisers and law enforcement experts.
“There is an encouraging trend towards formalising corporate incident response preparations. But with the source and impact of threats becoming harder to predict, executives should make sure that incident response becomes an organisational reflex rather than just a plan pulled down off the shelf,” says James Chambers, a senior editor at The Economist Intelligence Unit.
Arbor Networks president Matthew Moynahan comments: “As these findings show, when it comes to cyber-attacks, we live in a “when” not “if” world. In the wake of recent high profile targeted attacks in the retail sector, a company’s ability to quickly identify and classify and incident, and execute a response plan, is critical to not only protecting corporate assets and customer data, but the brand, reputation and bottom line of the company.”
Key findings of the survey include:
* The level of preparedness is being held back by lack of understanding about threats – only 17% of business leaders feel fully prepared for an incident; 41% of business leaders feel a better understanding of potential threats would help them be better prepared; having a formal plan or team in place has a significant effect on feeling of preparedness among executives; and half of all companies feel that they are unable to predict the business impact when a breach occurs.
* Emphasis on reputation is driving the formalisation of plans and processes – two-thirds of executives say that responding effectively to an incident can enhance their firm’s reputation; the percentage of organisations that now have an incident response team and plan in place is set to rise above 80% in the next few years; and firms that have suffered an incident in the past 24 months are twice as likely to have an arrangement with a third party expert as firms that have not suffered an incident.
* Firms remain reticent about disclosing incidents and sharing intelligence about threats – 57% of organisations do not voluntarily report incidents where they are not legally required to do so; and only a third of companies share information about incidents with other organisations to spread best practice and benchmark their own response.
