SESSION ID:

#RSAC

Ron Hale Ph.D., CISM

State of Cybersecurity:2016 Findings and Implications

AST1-R02

Chief Knowledge OfficerISACArhale@isaca.org

Jennifer LawinskiEditor-in-Chief RSA ConferenceJennifer.lawinski@rsa.com

#RSAC

Topics Professionals Want to Know About

2

RSA Conference submissions tell the story:

#RSAC

Top 10 Topics

3

1. Internet of Things2. Industrial Control Systems and the Industrial Internet of Things3. Encryption4. Artificial Intelligence and Machine Learning.5. Crowdsourcing6. The Role of the Researcher7. Healthcare and Automotive8. Security Meets the Board of Directors9. Privacy and Legislative Volatility10. INAMOIBW

#RSAC

The Internet of Things is a Big Deal

4

For the second year in a row submissions around IoT surged, showing that it’s a topic on the minds of security professionals.

The survey this year asked questions about IoT and respondents agree it’s a major issue that they’ll be facing in years to come.

#RSAC

AI and Machine Learning Have You Worried

5

More sessions focused on artificial intelligence and machine learning like “Rise of the Hacking Machines," and the survey results showed that security pros are concerned.

#RSAC

Security Meets the Board of Directors

6

Companies are looking to bridge the gap between threat intelligence and risk management, but many of the respondents to our survey don’t feel they have the security personnel and processes in place to handle serious security threats.

#RSAC

Survey Results Review

7

The State of

Cybersecurity2016

Summary Findings

#RSAC

Four Prominent Questions

8

1. What are enterprises experiencing in terms of cyber-incidents?

2. How concerned are enterprise decision makers?

3. Are security organizations capable of addressing cyber-incidents?

4. What does the future hold given new technology directions?

#RSAC

Were You a Victim in 2015?

9

Yes

No

Don’t know

33.41%

48.91%

17.68%

10% 20% 30% 40% 50% 60%

#RSAC

Likelihood of Being a Victim in 2016?

10

Very Likely

Likely

Not Very Likely

Not Likely at All

Don’t Know

42.17%

32.17%

16.52%

1.09%

8.04%

10% 20% 30% 40% 50% 60%

#RSAC

Frequency of Attack

11

Online Identity TheftHacking

Malicious CodeLoss of Intellectual Property

Intentional Damage to Computer SystemsPhysical Loss

PhishingDenial of ServiceInsider Damage

Don’t Know

Daily4.08%

11.06%16.36%

1.44%0.95%1.42%

29.67%4.05%2.91%

13.13%

Monthly5.52%9.18%

12.85%4.08%5.01%9.69%

15.19%9.76%9.69%3.86%

Weekly4.56%7.29%

12.38%2.40%1.43%6.38%

16.82%5.48%1.69%2.32%

Quarterly20.62%25.18%26.40%19.90%18.38%37.12%18.69%27.38%21.79%

6.18%

22.8%8.4% 6.3% 8.7%

1

2

3

4

#RSAC

Frequency of Attack – Known and Unknown

12

Online Identity TheftHacking

Malicious CodeLoss of Intellectual Property

Intentional Damage to Computer SystemsPhysical Loss

PhishingDenial of ServiceInsider Damage

Don’t Know

Known34.77%52.71%67.99%27.82%25.78%54.61%80.73%46.67%36.08%25.48%

Unknown65.23%47.29%32.01%72.18%74.22%45.39%19.63%53.33%63.92%74.52%

53.8%46.2%

#RSAC

Ability to Detect and Respond

13

31.41%

42.08%

17.35%

4.56%

Yes

Yes – Simple Issues

No

Do not know

Not applicable 2.60%

10% 20% 30% 40% 50% 60%

#RSAC

Level of Board Concern

14

Very concerned

Concerned

Not concerned

Not concerned at all

Don’t know

Not applicable

35.7%

46.0%

7.8%

2.6%

0.9%

7.0%

81.7%

10% 20% 30% 40% 50% 60%

#RSAC

Executive Team Support for Risk Mitigation

15

Enforcing security policy

Providing funding

Following food practices

Mandating awareness

Do not know

Not applicable

66.08%

63.0%

42.95%

58.37%

5.95%

6.61%

10% 20% 30% 40% 50% 60%

#RSAC

Security Reporting Structure

16

CEO

CIO

CFO

Audit

Board of Directors

Undefined

Don’t know

Not Applicable

13.62%

63.24%

4.37%

1.29%

8.23%

3.08%

3.34%

2.83%

10% 20% 30% 40% 50% 60%

#RSAC

Time to Fill Open Cyber Positions

17

< 2 Weeks

1 Month

2 Months

3 Months

6 Months

Cannot Fill

Don’t Know

1.1%

8.1%

17.5%

26.2%

27.5%

9.0%

10.7%

10% 20% 30% 40% 50% 60%

#RSAC

Applicants Qualified on Hire

18

32.7%

26.6%

16.8%

11.8%

12.2%

Less than 25%

25 – 50%

50 – 75%

75 – 100%

Do Not Know

10% 20% 30% 40% 50% 60%

#RSAC

Most Significant Skill Gap

19

60.9%

75.3%

61.1%

0.6%

Technical skills

Business Understanding

Communications

Other

#RSAC

How Are Skills Developed

20

On the job trainingSkilled based training / Performance based testing

Vendor specific tool trainingOther training & certifications

Formal educationTechnical training center or 3rd party trainers

Cyber competitionsOnline training / webinars

Self-instructionNot developing skills

Does not need to develop skillsOther

85.8%38.1%51.9%63.2%16.0%26.7%5.3%47.9%58.0%7.0%0.9%4.8%

#1

#2

#3

#4

#RSAC

Artificial Intelligence and Cyber Risk

21

41.9%

2.8%

62.0%

Increase in the short-term

Decrease in the short-term

Increase in the long-term

Decrease in the long-term

Remain the same in the short-term

Remain the same in the long-term

Don’t know

7.4%

11.7%

5.6%

8.9%

10% 20% 30% 40% 50% 60%

#RSAC

Concern for Internet of Thing Risk

22

18.7%

34.3%

9.3%

Very concerned

Concerned

Not concerned

Not concerned at all

Don’t know

Not applicable

3.9%

9.11%

24.7%

10% 20% 30% 40% 50% 60%

#RSAC

Action Items

23

Assess your capabilities to detect and respond to incidents

Have an honest discussion with decision makers

Identify skill needs and develop a strategy

#RSAC

For a Copy of the Report

24

www.isaca.org/state-of-cybersecurity-2016