RSA, the Security Division of EMC has released data demonstrating that organisations that invest in detection and response technologies, rather than perimeter-based solutions, are better poised to defend against cyber incidents.<\/p>\n
The second annual RSA Cybersecurity Poverty Index, which compiles survey results from 878 respondents across 81 countries and more than 24 industries, attracted more than double the number of respondents as last year, and gave participants the chance to self-assess the maturity of their cybersecurity programmes leveraging the NIST Cybersecurity Framework<\/a> (CSF) as the measuring stick.<\/p>\n The report found that for the second year in a row, 75% of survey respondents have a significant cybersecurity risk exposure. Incident Response (IR) capabilities are particularly underdeveloped. Nearly half of organisations characterised essential IR capabilities as \u201cad hoc\u201d or \u201cnon-existent\u201d, but organisations are more likely to accelerate programmes to shore up cybersecurity capabilities once they have experienced a security incident that impacted the business. The survey also showed that most organisations continue to struggle to improve cybersecurity because they don\u2019t understand how cyber risk can impact their operations.<\/p>\n There has been plenty of anecdotal evidence that companies tend to delay investments in cybersecurity until they experience the pain first hand. In addition, companies which primarily rely on a perimeter defense philosophy are disadvantaged in finding malicious activity, and risk public exposure of critical business assets. The results of the RSA Cybersecurity Poverty Index solidified this concept, reporting that the organisations that detect and experience frequent security incidents are 65% more likely to have developed capabilities. Organisations must focus on executing preventative strategies and make improving this a priority over other capabilities which are growing in importance such as detection and response.<\/p>\n One of the most significant changes from the 2015 survey was the increase in the number of organisations with mature cybersecurity programmes. The percentage of organisations reporting advantaged capabilities \u2013 the highest category \u2013 increased by more than half over the prior Index, from 4.9% to 7.4%. However, organisations\u2019 overall perception of their cybersecurity preparedness continued to lag. The number of respondents reporting significant cybersecurity risk exposure stayed steady at nearly 75%, reflecting a growing disparity between the \u201chaves and have-nots\u201d in security preparedness.<\/p>\n