News

12:00 PM
Connect Directly
RSS
E-Mail
50%
50%

Corporate Boards Weak On Security, But Improving

Study finds more than half of Fortune 1000 companies lack a CISO, but the number of organizations with cross-functional teams for managing security and privacy is up significantly.

More than half of Fortune 1000 companies lack a full-time chief information security officer, only 38% have a chief security officer, and just 20% have a chief privacy officer. As a result, a majority of companies are failing to adequately assess and manage the risks that information security and privacy issues pose to their business.

Those findings come from "Governance of Enterprise Security," a new study released yesterday by Carnegie Mellon University's CyLab. The report is based on a survey of 66 board directors or senior executives who work at Fortune 1000 companies. Nearly half of respondents work at critical infrastructure companies. CyLab conducted a similar survey in 2008.

According to the report's author, Jody Westby, who's CEO of Global Cyber Risk and a distinguished fellow at CyLab, "the survey results indicate that boards and senior executives need to be more actively involved in the governance of the privacy and security of their computer systems and data."

For starters, no respondent identified one of their board's top-three priorities as involving computer or data security, and only 2% said that their board actively addressed IT operations and vendor management. Furthermore, 65% of boards failed to review their business's insurance coverage for any cyber-related risks.

The new survey did, however, find some improvements. For example, the number of organizations with a risk committee that's separate from an audit committee rose from 8% in 2008 to 14% in 2010. Even so, only about two-thirds of those risk committees oversee their company's privacy and security practices. According to Westby, failing to have a proper risk management program, and instead simply using audit committees to manage IT risks and security programs, can create a number of "segregation of duties issues."

Organizations, however, are getting better at recruiting board-level members who add more security smarts. According to the report, "another positive sign from the survey was the importance that boards are placing upon IT security and risk expertise in board recruitment." Indeed, three-quarters of respondents rated IT experience as at least "somewhat important" when recruiting new directors, while 86% said the same for risk management or security expertise.

In another positive sign, the report found that 65% of organizations now have a cross-functional team for managing security and privacy, compared with only 17% of organizations in 2008.

Comment  | 
Print  | 
More Insights
Cartoon
Slideshows
Audio Interviews
Archived Audio Interviews
Jeremy Schulman, founder of Schprockits, a network automation startup operating in stealth mode, joins us to explore whether networking professionals all need to learn programming in order to remain employed.
White Papers
Register for Network Computing Newsletters
Current Issue
2014 State of Unified Communications
2014 State of Unified Communications
If you thought consumerization killed UC, think again: 70% of our 488 respondents have or plan to put systems in place. Of those, 34% will roll UC out to 76% or more of their user base. And there’s some good news for UCaaS providers.
Video
Twitter Feed