EU managers need to improve cyber security collaboration

A new study had shown that poor collaboration on cyber security issues between senior levels of business is leaving UK companies exposed to both fines and reputational damage. US network security company, Palo Alto Networks, conducted the survey, which highlights that almost half of respondents from companies in the UK, Belgium, France, Germany and the Netherlands, felt that the responsibility for protecting an organisation from cyber security problems lay fully with the IT department. Most respondents showed a growing understanding of the cyber risks facing business. At the same time however, one in 10 employees felt that the company’s top people didn't have an accurate understanding of cyber security issues. Other findings included that companies typically measure cyber security effectiveness through their ability to either repel or deal with attacks, but the report’s authors argue that pre-emptive and real-time measures are also needed to provide an accurate view of risk.

The lack of collaboration on cyber security between the senior levels of business is leaving UK firms exposed to fines and reputational damage, a study has revealed.

One in 10 C-level respondents to a survey by Palo Alto Networks said they “kind of” understand what defines an online security risk, but admitted they “still have to use Google to help explain it”.

This finding suggests that the lack of consensus on where the responsibility for cyber security lies could stem from some lack of cyber security understanding at the leadership level.

The study concludes there is still much work to be done in the area of collaboration and sharing responsibility when it comes to preventing data breaches.

The survey of more than 760 business decision makers in the UK, Germany, France, the Netherlands and Belgium found that a significant amount of accountability is placed solely on the shoulders of IT.

Nearly half of respondents believe that ultimate responsibility for protecting an organisation from cyber security risk lies with IT.

Even 57% of IT department respondents said they had sole domain over a company’s security.

GDPR shares data responsibility across business However, the European Union’s (EU’s) General Data Protection Regulation (GDPR), which is expected to be enforced by spring 2018, assigns responsibility to anyone who has access to data in the event of a breach – from customer service to IT and executives. Failure to comply with provisions of the GDPR could result in fines of up to €20m or 4% of worldwide annual turnover, whichever is greater. Read more about the GDPR More than half of European companies do not know about the legislation planned to unify data protection laws.

Only half of UK IT decision-makers are aware of the coming EU data protection regulation, compared with 87% in Germany.

The vast majority of cloud providers are not yet prepared to meet the requirements of the EU General Data Protection Regulation. While the majority of respondents demonstrated a growing understanding of the cyber risks that businesses face, 1 in 10 employees still do not believe the company’s executives or board have a relevant or accurate understanding of current cyber security issues to prevent their organisation’s computing environment from compromise. The study notes that while regulation and frameworks will standardise measures of success in relation to cyber security effectiveness, internal agreement is required in the meantime to allow for roles and responsibilities to be defined and for businesses to reach consensus on a unified approach.