A new report published by the BCI and sponsored by Sungard Availability Services confirms cyberattacks are a constantly evolving threat that is growing more dangerous by the day. The organisations surveyed spanned a variety of industry sectors including finance and insurance (29%), IT and communications (19%), professional services (16%) and health and social care (7%).
The report notes that the top three cyber-attacks continue to be phishing/social engineering, malware and ‘spear-phishing’ (an email-spoofing attack that targets a specific organisation or individual), while new entrant ransomware sits at number five. With fresh cyberattacks making news headlines on an almost daily basis, it is reassuring that 60% of senior management claim to have a high commitment to cyber resilience.
Around two out of three organisations (64%) reported at least one cyber disruption in the last twelve months, while some 15% had experienced more than ten. More alarmingly, roughly one in six organisations did not know whether a disruption had occurred or not, which suggests a lack of cybersecurity awareness in the organisation and the likely presence of information silos.
The survey of 734 business continuity and risk management professionals reveals that more than two-thirds of those surveyed (67%) take over an hour to respond to a cyber incident, with 16% admitting to a response time of four hours or more. This is a cause for concern as industry experts recommend responding to an incident within the first hour of discovery, commonly known as the ‘golden hour’.
In the Middle East & North Africa, the picture is even worse with only 12% taking less than hour to react to a cyber incident and one in three (33%) taking three hours or longer.
The research showed validation is key to building cyber resilience, with 55% of organisations testing their cyber resilience capabilities through exercising while 47% conduct penetration tests.
About a third of the respondents (33%) suffered disruptions costing more than €50,000, while more than one in ten (13%) experienced losses of €250,000 or more. Segmenting the data for small and medium enterprises (SMEs), which made up a quarter of the sample, showed that 18% suffered a disruption of €50,000 or more. Considering that 40% of the SMEs involved in the survey have an annual turnover of less than €1 million, these appear to be significant losses.
On a brighter note, several respondents stated how business continuity is no longer separated from IT and cyber departments, recognition that a sound business continuity plan must take into account the effects of a malicious online attack in order to guarantee continuity in the current threat landscape.
The report concludes with four key findings:
- BC professionals need to collaborate and engage with their cyber/Information Security colleagues to pool their expertise and respond to incidents, something that increasingly appears to be happening.
- Reputation management remains a key driver in pushing the cyber resilience agenda with large and small organisations alike aware of the potential for damage to their brand.
- As supply chains continue to be more complex – 43% of survey respondents depend on more than 20 suppliers – an organisation’s cyber resilience is heavily influenced by the cyber resilience of its supply chain.
- As we are already seeing with the EU General Data Protection Regulation (GDPR), legislative and regulatory changes are expected to drive cyber resilience as governments and data protection bodies worldwide tighten rules concerning storage and use of personal data.