The results of a study conducted by BAE Systems published this week suggest that major organisations are struggling to deal with the ramifications of successful cyber attacks. It seems one of the main issues is deciding which members of staff should take responsibility for managing the response to a breach, according to BBC News.
There is a disconnection between how people in different departments and positions of power within modern organisations feel that hacks should be handled. Those in management tend to lay this responsibility at the feet of those in IT, while tech decision-makers believe that the individuals on the board of the company should step up and take charge in this type of scenario.
Analysts believe that this state of affairs is causing businesses to be more susceptible to attacks, which only exacerbates the problem further.
Report spokesperson, Dr Adrian Nish, said that there is a division not only in terms of who is held responsible for taking the reins in the aftermath of a breach, but also in the extent to which particular members of staff understand the attack and appreciate how much recovery will cost to achieve.
Hundreds of IT managers and executives representing many of the world’s biggest organisations were questioned as part of the report. Half of those working in tech departments put the onus on board members to take responsibility for dealing with hacks and to formulate policies relating to appropriate responses.
This view is shared by 66% of executives, leaving a sizable minority who see IT staff as being the ones who should bring their expertise to bear on this matter, first and foremost.
A lack of understanding, compounded by inadequate communication between departments and decision-makers, is leading to costly breaches in many instances, Dr Nish argues.
Those in IT estimated that successful cyber attacks would lead to a firm typically having to spend £15 million to recover. This figure was put at £9.2 million by executives, revealing the extent of the discrepancy between the expectations of each group.
Industry observers have argued that this study shows just how important it is for board members to take cyber security more seriously than is currently the case, while also being encouraged not to underestimate the potential expenses associated with business continuity and recovery after a breach.
BCS spokesperson, Adam Thilthorpe, said that it did not matter which industry a business operated in; when it comes to IT there is no modern organisation which is not in some way intertwined with technology and thus at risk of cybercriminal activity in some shape or form. So arguments over responsibility can only leave firms vulnerable.
He also said that there were many major examples of high profile breaches against big businesses in which a better plan of response might have averted disaster, referencing in particular the hack of telecoms firm, TalkTalk, which was perpetrated by a teenager two years ago.
Others claim that cultural changes need to occur within big business in order to ensure that cyber security is a matter that is given adequate attention at all levels and across all departments, not just something which is seen as the sole responsibility of IT staff. This holistic approach is deemed to be a preventative measure in itself, as awareness of the risks will make it less likely that a breach can occur in the first place.
Analysts argue that while this report looks primarily at multinational firms, the lessons it contains are applicable to businesses of all sizes, no matter the industry or market place in which they operate.