More companies are hiring CISOs as private industry faces cyberattacks, report says

Cybersecurity budgets continue to grow, but so do risks of attack, according to annual survey.

As cybersecurity budgets and staffing needs continue to increase, businesses must also move to address increasingly malicious threats, according to ISACA’s annual global cybersecurity survey.

More than half of respondents — 53 percent — reported an increase last year in cyberattacks, with 80 percent reporting that an attack is likely to strike their business in 2017, according to the survey of 600 firms. Just 53 percent, however, reported that their business had a formal process for handling these attacks.

One concrete sign that cybersecurity is gaining more attention from businesses: The number of organizations with chief information security officers, or CISOs, is up 15 percentage points, according to ISACA’s 2016 State of Cyber Security report, with 65 percent now including the position. But while cybersecurity is becoming more of a concern, the availability of tools to combat attacks is not keeping pace.

“Consider that this year’s survey found that only fewer than half of security leaders are confident in their team’s ability to handle anything beyond simple cyber incidents,” ISACA CEO Matt Loeb wrote in the report. “To say that is concerning is an understatement. Resources must be allocated to sharpening those skills and improving organizations’ abilities to rapidly detect and respond to advanced cyber threats.”

The Internet of Things has usurped mobile as an increasing security concern, according to the report. Meanwhile, the budget for cybersecurity continues to grow, but this growth is down 11 percentage points from last year’s report.

As cyberattacks, specifically ransomware, become a growing area of concern, businesses are also finding challenges in filling cyber security positions. “One-third of the respondents note that their enterprises receive more than 10 applications for an open position,” the report states, “but 64 percent of that one-third indicate that fewer than half of the applicants are qualified.”

Loeb wrote that information about security must be shared amongst organizations and additional resources must be allocated to cybersecurity to address these evolutions in the field. But “building and maintaining a strong cybersecurity workforce” is key.

“Security professionals must not only be trained, but have their skills maintained using hands-on technical training and hands-on performance based assessment,” Loeb stated. “And this must be done while also assuring that these professionals understand the nature of the businesses for which they work.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure