More funds not enough to curb India Inc's cybersecurity threat

Speaking on the occasion, Gulshan Rai said: “We are at the cusp of a cybersecurity paradigm shift and it is imperative that for the overall national security we join hands to share, evaluate and acquire threat intelligence and develop a robust operational framework to use this with security technologies. We will need immense focus to encourage technological innovations in cybersecurity to secure national critical infrastructure from cyber criminals.”

Increasing risk exposure

According to the survey, outdated information security architecture and controls has most increased risk exposure for India Inc over the last 12 months, with as many as 61 percent of the respondents citing this aspect as their topmost vulnerability.

Careless or unaware employees is their second-most important concern (58 percent), while vulnerabilities related to mobile computing, social media and cloud computing also feature prominently as contributing to enhanced risk exposure for corporate India. Among threats, the majority (54 percent) believe that cyber-attacks are primarily targeted at defacing/disrupting organizations or towards stealing intellectual property or data (51 percent), followed by fraud (48 percent).

Says Nitin Bhatt, EY India’s Risk Advisory Leader, “Disruptive innovations and the digital transformation of businesses and governments are exponentially enhancing cyber-risks. What is worrisome is that the response gap - which is the difference between the abilities of the attackers and the capabilities of organizations is increasing as well, leading to this lack of confidence in the cybersecurity function.”

The survey highlights that while respondents are more confident of their ability to predict and detect a cyber-attack with 52 percent saying that they would be able to do so, but not enough attention is being given to building basic, yet essential capabilities. More than half of the respondents (55 percent) do not have a formal, threat intelligence program, while 44 percent do not have a vulnerability identification capability.

Further, more than a third (33 percent) do not have a security operations center (SoC), which serves as a continuous monitoring mechanism. More than half (52 percent) would not increase their cybersecurity spending after experiencing a breach which did not appear to do any harm, which the report highlights as a matter of concern, observing that ‘cyber criminals often making test attacks or lie dormant after a breach.’            “The need of the hour is for organizations to review if their security governance and architecture is adequate to protect their crown jewels. Since cyber resilience cannot be achieved by buying “security-in-a-box,” organizations need to focus on gathering periodic threat intelligence, enhancing their threat-hunting and breach-detection capabilities, and institutionalizing a robust incident-response framework,” Bhatt further said.According to the Indian respondents, management and governance issues (42 percent), followed by   lack of quality tools for managing information security and lack of executive awareness and support (41 percent) were seen as the main challenges for information security operations as compared to lack of budgets (61 percent) and skilled resources (56 percent) globally. 38 percent of the Indian respondents say that boards are not fully knowledgeable about cyber risks.More than a third of the Indian respondents (37 percent) cited budget constraints and lack of skilled resources (39 percent) as obstacles. The survey underscores the importance of reporting to enhance executive awareness and support. More than three-fourth of the respondents indicated that they do not  evaluate the financial impact of every significant breach and those that have had a cyber breach in the last year, more than half (57 percent) have no idea of the financial damage incurred.Challenges of the digital ecosystem and connected devicesOn the impact of the Internet of Things (IoT), the report states that organizations are struggling with the huge number of devices that will become part of their networks, challenges related to the size of data traffic and the expanding eco-system of business partners. The most important information security challenges of IoT were identified as finding hidden or zero-day attacks (50 percent), identifying suspicious traffic over the network (44 percent) and ensuring that implemented security controls are meeting the requirements of the day (40 percent).

On the growing use of mobile devices such as laptops, tablets and smartphones, more than half (55 percent) see poor user awareness as the most significant risk, followed by (41 percent) loss of device which leads to loss of information and identity.

Among information security priorities over the next 12 months, business continuity and disaster recovery which are at the heart of an organization’s ability to react to an attack – was rated by respondents as their top priority (63 percent), along with data leakage and data loss protection (60 percent).  Although 43 percent plan to spend more on  business continuity in the coming year and  37 percent plan to spend more on data leakage, there is also considerable  focus on higher spends on security awareness and training of employees, vendors and business partners, cloud computing and threat and vulnerability management (38 percent).