Story image

Australian CISOs say cloud compliance is one of the most stressful parts of the job

04 Jul 17

The task of making sure cloud applications follow compliance policies is one of the most stressful areas of a chief information security officer's (CISO's) job, and they also believe their CEOs are undermining internet security protocols.

Those are the sentiments from Symantec's latest research, which suggests that there are gaping areas in both their organisation's security and the people involved in implementing it.

74% of Australian CISOs believe that their CEO has broken internal security protocols, whether intentionally or unintentionally.

86% say that making sure cloud applications are in line with compliance protocols is the most stressful part of their jobs, but that isn't all they are concerned about.

Hijacking threats top-of-mind for Australian CISOs

32% of CISOs believe account hijacking may become a top threat this year; followed by data breaches (30%); exploited system vulnerabilities (19%); hacked APIs (12%); and broken authentication and compromised credentials (7%).

When looking specifically at cloud security, data loss; staff non-compliance; training; and insecure business applications topped the list of the biggest threats this year. 91% believe that regular data backups cannot work on their own to stop attacks and malware.

29% of cloud applications used at a CISO's company count as shadow apps, which are easy targets for cybercriminals, the survey revealed.

CISOs also tip open source software as a major concern this year, with 99% stating it will be bigger than last year.

Industry compliance issues may be going in the wrong direction

CISOs reported worries about a number of different industry compliance issues today, including:

  • Tracking of activities in sanctioned cloud applications (21 per cent);
  • country and region-specific data residency and control regulations (17 per cent);
  • broad sharing of compliance-controlled data in cloud applications (25 per cent);
  • governance of corporate-owned mobile devices (15 per cent); and
  • employee use of unsanctioned cloud applications (22 per cent)

So what are CISOs doing about it?

According to the survey, CISOs are looking for three key factors to support their security and policies for both data compliance and residency.

89% say they are looking for tokenisation as the best way to meet data residency and control; but only 61% currently use it. 88% use cloud encryption and only 51% use both.

General focus areas: More training, bigger budget, better protection

95% of Australian CISOs plan for more spending on staff training. New employees may average 20 hours of security training during the onboarding process - one of the longest training times out of all countries surveyed in the research..

Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t. 
Pitfalls to avoid when configuring cloud firewalls
Flexibility and granularity of security controls is good but can still represent a risk for new cloud adopters that don’t recognise some of the configuration pitfalls.
Securing hotel technology to protect customer information
Network security risks increase exponentially as hotels look to incorporate newer technologies to support a range of IoT devices, including smart door locks.