The 2019 State of Cybersecurity study from India's second largest outsourcing company, Wipro, also highlights the emergence of the CISO as a C-Suite role, and found that one in five CISOs are now reporting directly to the CEO, 15% of organisations have a security budget of more than 10% of their overall IT budgets, 65% of organisations are tracking and reporting regulatory compliance, and 25% of organisations are carrying out security assessments in every build cycle.
In addition, 39% of organisations now have a dedicated cyber insurance policy, with all of these points showing dramatic increases from previous years.
The annual study is based on three months of primary and secondary research, including surveys of security leadership, operational analysts, and 211 global organisations across 27 countries.
WIPRO lists additional highlights from the report as:
1. More data exposed, yet a decline in the number of publicly disclosed breaches. While the number of significant publicly reported breaches decreased by 25%, the number of records exposed during attacks increased by 164% to 232 records exposed per second. Attackers also targeted more specific information perceived to have higher monetary value: 38% of the data records breached/targeted were a combination of personally identifiable information and security credentials such as passwords.
2. Cryptominers are the new big threat. Cryptominer malware surged to become the new emerging threat: 25% of global organisations were targeted by Coinhive malware alone in 2018. 80% of all cryptomining attacks originated from just three sources: Coinhive, Cryptoloot, and JSEcoin. Ransomware attacks by contrast declined in 2018.
Yet organisations are aligning themselves to cyber-resilient strategies in new ways:
1. Cloud and IoT security strategies on the radar. With cloud and IoT adoption on the rise, 28% of organisations perceive cloud account hijacking as one of the top security threats to their cloud environments. 26% of organisations are prioritising security assessment of IoT devices to mitigate new risks.
2. Collective wisdom trumps learning in isolation: 67% of organisations are now willing to share indicators of compromise (malicious IPs, URLs, domains), and 33% of organisations are willing to share attacker tactics, techniques, and procedures with industry peers. Information sharing and timely threat intelligence have become critical enablers in anticipating and mitigating new and developing attacks.
3. More pervasive approach to protection. 39% of organisations now have a dedicated cyber insurance policy, up by 12% from 2017; 28% of organisations participate in cyberattack simulation exercises coordinated by industry regulators; and 1 in four organisations now carry out security assessments in every build cycle.
Raja Ukil, Global Head for Cybersecurity & Risk Services, Wipro said: “With organisations riding the digital wave, security strategies need to be enhanced to address the changing landscape and enable a smooth and safe transition.
“Security is also evolving to be a pervasive part of core business operations, and countries are establishing active cyber defence strategies and functions to foster partnerships with the private sector enterprises and with other countries.
“Amidst growing threats, leaders are collaborating more than ever before in new and innovative ways to mitigate the risks.”