C-suite more concerned about the costs of cybersecurity breaches than losing customers

Centrify research finds two-thirds of UK organisations admit that privileged identity and access management would have most likely prevented significant cybersecurity breaches

For UK senior executives who admit their organisations have suffered at least one significant cybersecurity breach within the past two years, the associated costs of a breach are considered the most important consequence, according to a new study by Centrify.

Nearly two-thirds (63%) of respondents in the UK believe investigation, remediation and legal costs are the most important consequences of a breach, followed by disruption to operations (47%) and loss of intellectual property (32%).

While they showed less concern for impact on brand and loss of customers (16%) and damage to the company’s reputation (11%).

The study of 800 senior level executives, including CEOs, Technical Officers and CFOs in the UK and US, also indicates that there is confusion among the C-suite about what constitutes a cybersecurity risk and what needs to be done to prevent it.

Malware

In the UK, malware is seen as the biggest threat to an organisation’s success among 44% of respondents, compared to just 24% who point to default/weak or stolen passwords and 29% who blame privileged user identity attacks.

However, of those organisations that experienced at least one significant security breach in the past two years, just 11% admit it was due to malware, while almost twice as many put it down to either a privileged user identity attack or the results of stolen or weak passwords (both 21%).

63% of UK organisations that experienced a major breach admit that privileged identity and access management would have most likely prevented the breach.

The Verizon 2017 Data Breach Investigation Report indicates that 81% of breaches involve weak, default or stolen passwords.

More than half (53%) of respondents at breached organisations say audit trails for system accesses, and a quarter say training or awareness would most likely have stopped a breach.

According to the survey, the largest area of cybersecurity investment over the next 12 months will be for malware (44%) and phising (38%), while protection against stolen or weak passwords (33%) and privileged user identity attacks (26%) are investment priorities for fewer respondents.

Barry Scott, CTO EMEA at Centrify, explains: “It’s no surprise that the C-suite often points to malware as the biggest threat. Sensational headlines about major attacks could be to blame, which companies see and react to, often mistakenly, when in fact identity-related attacks – such as stolen or weak passwords, and attacks on privileged users within organisations – are the primary threat to cybersecurity today.

“What’s worrying is that they then look to invest money in protecting against malware, when in fact they should be focusing on the increase in identity-related attacks. Business leaders need to rethink their strategy with a Zero Trust Security approach that verifies every user and every device, and provides just enough access and privilege.”

View the study: https://www.centrify.com/resources/ceo-disconnect-weakening-cybersecurity/