Organisations with top executives who aren't involved in cybersecurity decisions face a serious problem — a major hit to their bottom lines, according to a recent report.
"Many organisations see cybersecurity as solely an IT problem," says Karen Hughes, director of homeland security standards programmes at the American National Standards Institute (ANSI), one of the major sponsors of the report, titled "The Financial Management of Cyber Risk". "We are directing a wake-up call to executives nationwide. The message is, this is a very serious issue, and it's costing you a lot of money."
The report recommends how C-level executives can implement cybersecurity risk management programmes at their companies. Part of the goal is to get executives such as chief financial officers directly involved in cybersecurity efforts, said Larry Clinton, president of the Internet Security Alliance (ISA), the other major sponsor of the report.
The report cites a cyberpolicy review released by President Barack Obama's administration last May saying that US businesses lost US$1 trillion worth of intellectual property to cyberattacks between 2008 and 2009. That number doesn't include losses due to theft of personal information and loss of customers, the report said.
The total cost of a typical breach of 10,000 personal records held by an organisation would be about $2 million, the report said.
"We believe if we can educate American organisations about how much they're actually losing, we can move to the next step, which is solving the problem," Clinton said. Eighty to 90 percent of cybersecurity problems can be avoided by a combination of best practices, standards and security technology, but some organisations need to understand the financial problems associated with poor security practices before they will make changes, Clinton said.
A small percentage of company CFOs are directly involved in cybersecurity plans at their companies, and at many companies, most employees don't see cybersecurity as part of their jobs, Clinton said. "In American organisations, everybody has data," he said. "Generally, people don't think it's their responsibility to secure their own data. They think that's the job of the IT guys down at the end of the hall."
IT departments at many US companies and organisations are viewed as cost centres, not profit centres, and are "starved for resources," Clinton added. Many employees don't understand, or are intimidated by, the cybersecurity tools their companies have, the report said.
US organisations need to understand that in today's connected world, their lack of security can hurt their customers, their partners and national security, Clinton and other cybersecurity experts said at a press conference.
Cybersecurity product vendor Symantec released 2.7 million signatures to fight malicious code in 2009, more signatures than in the previous 25 years combined, said Justin Somaini, the company's chief information security officer. The majority of that malicious code was in the form of Trojans targeting intellectual property and personal information, he said.
Somaini called the ISA/ANSI report a "call to arms" for US organisations.
"Most information security organisations struggle with implementing even the most basic solutions," Somaini said. "Most of the struggle comes from resistance within the organisation."
The report recommends ways companies can deal with cyber risk. Among the recommendations for top executives: Appoint a cyber risk team, develop a cyber risk management plan across all departments and develop a total cyber risk budget.