CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Interestingly, the two groups differed heavily when it came to their third choice. The IT and security
respondents found ransomware to be the next biggest concern, while the executives were more
worried about data alteration, where an attacker changes records or the code in something like
an automated assembly line.
Disagreeing on impact
While the two stakeholders generally had the same priorities for cybersecurity, we saw a major
difference in opinion when it came to assessing the business impact of a security incident. 31
percent of IT and cyber respondents held brand perception as their main concern, followed closely
by intellectual property loss. Costs such as fines and recovery expenses proved to be a much
lower priority.
The C-suite on the other hand took the opposite stance, with costs sitting firmly as the main
concern. This seems to demonstrate that IT and security practitioners are more focused on trying
to protect the company’s reputation and operations as a matter of course, while executives see
the impact on the businesses’ bottom lines as the deciding factor.
A lack of communication?
The biggest difference in opinion seemed to appear when we asked respondents about their
security readiness, specially asking if they agreed with the statement “My organisation is making
measurable progress when it comes to cybersecurity”. IT and security teams were quite
optimistic, with 91 percent agreeing with the statement. However, a markedly lower 69 percent of
executives felt this way.
The dissimilar perceptions largely stem from a lack of clear communication about the company’s
security efforts and the impact they have. This was made especially clear when it came to the
ever-pressing issue of finances. 88 percent of security and IT teams stated that they could quantify
how cybersecurity measures impact the business, but only 68 percent of the C-suite group felt
the same.
Taken together, this strongly suggests that executives need more information about their
cybersecurity investments and how they are making a quantifiable and justified impact on the
company’s bottom line. If senior management are not part of the security planning process there
is a problem: with more at stake in the event of a data breach, companies can no longer lay the
blame solely at the door of the IT security teams if there’s a security incident.
Time to speak up, security pros
Clearly, more needs to be done to get the C-suite and IT and security teams on the same page.
One of the most telling findings we uncovered from our survey was that the IT and security