Feeling insecure about your organization’s information security? In this case, perception may be everything.
Last fall, an information security survey conducted by PricewaterhouseCoopers LLP and CIO magazine found stark differences in infosec practices and outcomes. Security practitioners who rated themselves as “confident” in their organizations’ information security fared dramatically better than those rating themselves as “not confident”. Companies that said they are not confident suffered more incidents and monetary losses.
This year, CSO magazine’s quarterly “Security Sensor” poll revisited the confidence question to understand the underlying cause of insecurity.
Not surprisingly, the companies that lacked confidence in their information security are the same companies that were less likely to implement infosecurity best practices. Consider that a larger percentage of the nonconfidents fear insider breaches yet do less to address them. The nonconfidents also are less likely to be prepared to respond to an incident.
But the killer finding suggests that the root of the problem is a lack of effective security leadership. Companies without infosec confidence suffered greater damages. Senior management at these companies were also informed less frequently about information security. Clearly, the security function needs to improve its efforts to communicate with senior management.