10 best practices to reduce the probability of a material breach

ThoughtLab announced the findings of its 2022 cybersecurity benchmarking study which analyzed the cybersecurity strategies and results of 1,200 large organizations across 14 different sectors and 16 countries, representing $125.2 billion of annual cybersecurity spending.

The research revealed that the pandemic has brought cybersecurity to a critical inflection point. The number of material breaches respondents suffered rose 20.5% from 2020 to 2021, and cybersecurity budgets as a percentage of firms’ total revenue jumped 51%, from 0.53% to 0.80%. During that time, cybersecurity became a strategic business imperative, requiring CEOs and their management teams to work together to meet the higher expectations of regulators, shareholders, and the board.

In addition, the role of the chief information security officer (CISO) expanded, with many taking on responsibility for data security (49%), customer and insider fraud (44%), supply chain management (34%), enterprise and geopolitical risk management (30%), and digital transformation and business strategy (29%).

Yet 29% of CEOs and CISOs and 40% of chief security officers admit their organizations are unprepared for a rapidly changing threat landscape. The reasons cited include the complexity of supply chains (44%), the fast pace of digital innovation (41%), inadequate cybersecurity budgets and lack of executive support (both 28%), convergence of digital and physical assets (25%), and shortage of talent (24%).

The highest percentages of unprepared organizations were in critical infrastructure industries: healthcare (35%), the public sector (34%), telecoms (31%), and aerospace and defense (31%).

Over the next two years, security executives expect an increase in attacks from social engineering and ransomware as nation-states and cybercriminals become more prolific. Executives anticipate that these attacks will target weak spots primarily caused by software misconfigurations (49%), human error (40%), poor maintenance (40%), and unknown assets (30%).

Analysis reveals industry metrics and best-performing cybersecurity strategies

As part of this evidence-based research, economists assessed the cybersecurity performance of corporate and government organizations against 26 metrics, including times to detect, respond to, and mitigate a cybersecurity breach, as well as the number of material breaches suffered. The benchmarking study revealed 10 best practices that can reduce the probability of a material breach and the time it takes to find and respond to those that happen:

1. Take cybersecurity maturity to the highest level

Organizations that are most advanced in applying the NIST cybersecurity framework outperform others on key metrics, such as time to detect a breach (119 days for advanced vs. 132 days for others). They also have fewer annual material breaches (0.76 for advanced vs. 0.81 for others).

2. Ensure cybersecurity budgets are adequate

The analysis found a clear correlation between investment and results. Respondents reporting multiple material breaches in 2021 spent 12.3% of their total IT spending on cybersecurity, while those reporting no material breaches in 2021 spent an average of 12.8%, or $4.7 million more. Organizations that spent more also reported faster times to detect and mitigate a breach.

3. Build a rigorous risk-based approach

On average, risk-based leaders—i.e., those most advanced in quantitative analysis of risk probabilities and impacts—saw 22.5 incidents and 0.75 material breaches in 2021, vs. 27.1 incidents and 0.88 material breaches for risk-based beginners. In addition, 50% of top performers in time to mitigate took a risk-based approach vs. 17% of poor performers.

4. Make cybersecurity people centric

Cybersecurity is as much about humans as it is about technology. Organizations see fewer breaches and faster times to respond when they build a “human layer” of security, create a culture sensitive to cybersecurity risks, build more effective training programs, and develop clear processes for recruiting and retaining cyber staff.

5. Secure the supply chain

For 44% of respondents, the growing use of suppliers is exposing them to major cybersecurity risks. Top performers in time to detect, respond, and mitigate are far more mature in supply chain security. For example, over half of organizations with excellent times to detect are advanced in supply chain security vs. 25% of those with poor times to detect.

6. Draw on latest technologies but avoid product proliferation

Organizations with no breaches invest in a mix of solutions, from the fundamentals such as email security and identity management, to more specialized tools such as security information and event management systems (SIEMs). These organizations are also more likely to take a multi-layered, multi-vendor security approach to monitor and manage risks better through a strong infrastructure.

7. Prioritize protection of links between information and operating technologies

With digital and physical worlds converging, the attack surfaces for respondents are widening. Organizations that prioritize protection of interconnected IT and OT assets experience fewer material breaches and faster times to detect and respond.

8. Harness intelligent automation

Automation, combined with AI and orchestration, helps CISOs deliver results while freeing up staff from mundane tasks. For example, about three out of 10 organizations with excellent dwell times (the time to detect and remediate) use smart automation vs. 17% of organizations with poor dwell times.

9. Improve security controls for expanded attack surfaces

Attack surfaces widened during the pandemic because of greater digital transformation, cloud migration, remote working, and supply chain complexity. Our research shows that more companies need to put security controls in place to cover their expanding technology environments.

10. Do more to measure performance

Currently organizations track just 4.2 cybersecurity metrics on average. Executive teams that are more assiduous—monitoring six or more metrics—experience fewer incidents and material breaches. They also respond faster to attacks.

“The move to digital during the pandemic—and now escalating geopolitical tensions—are ushering in a new era of cybersecurity risk that will require stronger leadership and wider teamwork among C-Suite executives and their staffs,” said Lou Celi, CEO of ThoughtLab and the program’s research director.

“While there is no silver bullet, our evidence-based research reveals that organizations need to take their cybersecurity programs to a higher level of excellence by ensuring they are proactive, risk-based, human-centric, digitally advanced, and properly resourced.”

Source: https://www.helpnetsecurity.com/2022/05/12/2022-cybersecurity-strategies/