March 28, 2017 By Mark Samuels 2 min read

Most executives recognize the growing threat posed by cyberattacks, but few business leaders are putting the security strategy in place to help keep enterprise information safe and secure.

Although 94 percent of U.K. companies think the security of their IT systems is important, almost half (45 percent) do not have a formal security strategy in place, according to research from the Institute of Directors (IoD) and Barclays Bank.

The results of the survey raised concerns given the context of ever-increasing external threats and new legislative requirements, particularly the European Union’s General Data Protection Regulation (GDPR). IT decision-makers must ensure their business pays attention to policies and processes that can help reduce the risk of data exposure in light of these happenings.

Understanding the Need for Action

The research, which polled almost 1,000 business leaders, highlighted a general lack of preparedness among U.K. executives. Just one-third of business leaders use virtual private networks to help secure mobile communications, and only about half are familiar with two-factor authentication.

Education is another problem area for U.K. organizations. Just 44 percent have launched some kind of cyber awareness training. The report also found many organizations leave gaps of more than a year between running these training programs.

Even more troubling is the fact that as many as 40 percent of business leaders would not know who to contact to report online fraud. This lack of preparation and knowledge is a significant concern because of cybersecurity incidents during the past year and further legislative changes associated to the forthcoming GDPR.

Preparing for New Regulations

The GDPR is a new data protection framework that takes effect across Europe starting May 2018. It will expand the level of accountability organizations have for data breaches, and business leaders have to adhere to and prove they follow the principles of the framework.

All organizations will need to report data breaches to a supervisory authority within 72 hours and then to any affected individuals, explained Infosecurity Magazine. Failure to do so under the GDPR could result in fines of anything up to 10 million pounds or 2 percent of a firm’s global turnover.

These new regulations present a significant challenge to all businesses. And any lack of preparedness in terms of security strategies demonstrates how executives must start to formalize their policies and procedures.

Building a Better Security Strategy

In a news release, the IoD urged business leaders to step up their preparations for the GDPR now. It also advised that all directors and board members should be trained about the importance of a security strategy.

Additional research suggested the lack of preparation for GDPR stretches to other line-of-business departments beyond IT. About one-quarter of marketers believe their companies are unprepared, Marketing Week reported. Additionally, one-third do not expect to be compliant when the law comes into effect.

IT decision-makers and their C-suite peers should turn their attention to several key areas, including a thorough assessment of their organizational data and security audits to ensure any implemented security strategy is of the highest possible standard.

More from

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments. During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today