Endpoint

2/21/2018
09:01 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

C-Suite Divided Over Security Concerns

Survey shows 60% of CEOs plan to invest the most resources in malware prevention, but CISOs, CIOs, and CTOs are on a different page.

More than 60% of CEOs believe malware is the biggest threat to their organization, but just one-third of CISOs, CIOs, and CTOs agree. 

It's just one data point in a new study by identity management company Centrify that shows a major disconnect on this and many other security issues between CEOs and their technical officers (TOs), which include CIOs, CTOs and CISOs. 

CEOs and TOs also diverged on whether they knew if their organization had experienced a breach. Only 55% of CEOs say their organization experienced a breach, while 79% of TOs say so. On the technology front, 62% of CEOs say two-factor authentication technologies are difficult to manage, while only 41% of TOs concur with that statement. 

"Part of the problem is that the technical people tend to try to keep the breach quiet," says Tom Kemp, CEO at Centrify. "I think overall, the TOs need to do a better job managing up, because with SEC regulations and various state breach notification regulations, organizations really do have to report if they have been breached today."

Kemp points out that 42% of TOs point to identity breaches as one of the primary threats to their organizations. And 68% of executives whose companies experienced significant breaches indicate it would most likely have been prevented by either privileged user identity and access management or user identity assurance. Only 8% of all executives whose companies experienced a significant breach say that anti-malware technology would have prevented the more significant breaches with serious consequences.

Frank Dickson, an IDC analyst who focuses on identity and access management, points out that the 2017 Verizon Data Breach Investigations Report found that 81% of hacking-related breaches leveraged stolen and/or weak passwords.

"Our goal is not to eliminate malware, our goal is to eliminate breaches," Dickson says. "By strengthening authentication, it lets us build security into the network," and potentially eliminate the vast majority of breaches.

Lawrence Orans, a research vice president at Gartner who focuses on network security, says he doesn't think it's helpful to set security up as a choice between identity management versus malware detection.

"For example, malware could be used to steal credentials and execute an even broader attack," he says. "And it actually makes sense that there would be a disconnect between the CEO's understanding of new security technologies versus the TO's: that's what the CEO has the technical people for in the first place."

Centrify's Kemp maintains that TOs need to educate their CEOs on identity management issues, citing the three main tenets of so-called zero trust security:

  • Verify users. Companies can do this with single sign-on software that's layered in with two-factor authentication.
  • Validate devices. Have a procedure for determining if the devices are enrolled with the IT department with the right OS versions, patch levels, and antivirus software. IT must also check past usage, including a user's geography. (A user can't be in New York one minute, then San Jose five minutes later).
  • Limit access and privileges. Companies should move to a least-privilege model in which users only gain access to a system if they need it for their jobs, and only for a defined time period.

The study was based on a survey of 800 senior executives conducted in November 2017 by Dow Jones Customer Intelligence, a unit of the Wall Street Journal/Dow Jones Advertising Department. More than 75% of the executives surveyed are CEOs, CTOs or technical officers such as CIOs, CTOs and CISOs; the rest are their direct reports.

Related Content:

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...