PwC says UK Security Breaches Often Not Reported

the-importance-of-getting-the-right-technology-to-protect-your-business-jurga-zilinskiene-today-translations-8-638.jpg?cb=1404367953

 

The majority of UK organisations suffering a security or data breach will never report it to anyone outside the company, the PwC Information Security Breaches Survey covering 2014 has once again suggested.

It’s not a new finding, nor even a surprising one, but the scale of the issue is one of the noteworthy sections of what is now at 15 years and counting the longest-running IT breaches survey in the world.

PwC received 664 responses to feed into its 2015 survey, of which a scandalously low 42 even took on the question covering their reporting policy. Of these, 19 percent had reported security incidents to a government agency (including the ICO), 14 percent the police, 12 percent their ISP, 10 percent Action Fraud. Only 14 percent had owned up in public to the issue with more than one in five not even sure how or to whom a report should be made.
Meanwhile, breaches are up – of course - with 90 percent of large firms and 74 percent of smaller ones reporting an event, up from 81 percent a year ago.  
 “It appears that law enforcement agencies are not being informed of all attacks,” said the report’s authors with under-statement. “This makes it challenging for the agencies to estimate the scale and types of crimes that are being committed and respond accordingly.”

As for keeping the anti-virus firms in the loop, only 2 percent did that although not all incidents will have been connected to a failure of that security layers so this is not as dire as it might sound.
“This year’s survey echoes previous findings that the level of reporting in the UK remains low. Perhaps the fear of reputational damage and potential compensation costs along with the lack of reporting culture in this area means that most organisations are not willingly admitting to information security breaches,” added PwC.

Breaches also cost more than they did in the past, with the average ranging between £1.46 million and £3.14 million for large organisations and a still hefty £75,000 to £311,000 for smaller firms, and just as there are more breaches being detected, more of these are targeted at every level from internal to external or a combination of the two. A percentage of attacks now strike through partners or third parties rather than directly.
“A breach is pretty much inevitable for any organisation in the UK. Dealing with breaches is now a fact of life,” commented Deputy Director for Cyber Security and Resilience within the Department for Business, Innovation and Skills (BIS), Giles Smith, at the report’s Infosec Show launch event in London this week.

PwC lists a long and tedious list of causal factors although a lack of priority given to security was among the most prominent. Even now, in 2015, some organisations fail to take security seriously or, worse, think they are taking it seriously, without actually doing so at a deeper level.

One interesting side-note buried in the report is that the Government’s flagship Cyber-Essentials/Plus scheme seems to be doing well with half of all organisations either accredited or on their way to being so. There could be a phenomenon of self-selection in this (i.e. organisations more likely to complete PwC surveys are also those who take accreditation seriously) but it’s still a result of sorts not much more than a year after its introduction.

A further theme is the difficult balance between buying better security technology and training people to use it.
“Over a third of all cybersecurity investments are used for technical controls, while only a quarter of companies plan to invest in training staff,” noted EMEA managing director for (ISC)2 , Adrian Davis.
“This indicates that businesses are falsely reliant upon security technology instead of investing in vital staff education and training. No matter how strong your technical defences, poorly-trained employees have become a prime gateway for attackers to get in; and the complacency around awareness training is exacerbating the security breach issue.”

PWC ISBS 2014 Executive Summarry: http://ow.ly/OFmva 

Computerworld:  http://bit.ly/1Cfuf70

 

 

« FBI Unable to Monitor ISIS’s Encrypted Communications
Financial Services Firms Stare into the Abyss as Data Breaches Rocket »

Perimeter 81

Directory of Suppliers

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

FREE eBook: Practical Guide To Optimizing Your Cloud Deployments

AWS Marketplace eBook: Optimizing your cloud deployments to accelerate cloud activities, reduce costs, and improve customer experience.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

IEEE Computer Society

IEEE Computer Society

The IEEE Computer Society is the world's leading membership organization dedicated to computer science and technology.

Tresorit

Tresorit

Tresorit helps teams to collaborate securely and easily by protecting their data with end-to-end encryption.

NTOP

NTOP

NTOP develop high-quality network traffic analysis and DDoS protection software used by small individuals as well by large telecom operators.

Segusoft

Segusoft

With its encryption platform SEGULINK, Segusoft provides standard software for companies to securely transfer files and messages.

ALTEN Calsoft Labs

ALTEN Calsoft Labs

ALTEN Calsoft Labs provides next gen digital transformation, enterprise IT and product engineering services including Cybersecurity and Managed Security.

Academy of Cyber Security

Academy of Cyber Security

The Academy of Cyber Security is on a mission to provide affordable, accessible, & world-class education in cyber security.

Hyperwise Ventures

Hyperwise Ventures

Hyperwise Ventures lead seed investments in startups in the cyber security and enterprise software spaces.

Avertro

Avertro

Avertro helps leaders manage the business of cyber. We help explain cybersecurity to executives, forecasting outcomes, right-sizing your spend, and validating your cyber strategy.