Story image

Australian CISOs say cloud compliance is one of the most stressful parts of the job

04 Jul 2017

The task of making sure cloud applications follow compliance policies is one of the most stressful areas of a chief information security officer's (CISO's) job, and they also believe their CEOs are undermining internet security protocols.

Those are the sentiments from Symantec's latest research, which suggests that there are gaping areas in both their organisation's security and the people involved in implementing it.

74% of Australian CISOs believe that their CEO has broken internal security protocols, whether intentionally or unintentionally.

86% say that making sure cloud applications are in line with compliance protocols is the most stressful part of their jobs, but that isn't all they are concerned about.

Hijacking threats top-of-mind for Australian CISOs

32% of CISOs believe account hijacking may become a top threat this year; followed by data breaches (30%); exploited system vulnerabilities (19%); hacked APIs (12%); and broken authentication and compromised credentials (7%).

When looking specifically at cloud security, data loss; staff non-compliance; training; and insecure business applications topped the list of the biggest threats this year. 91% believe that regular data backups cannot work on their own to stop attacks and malware.

29% of cloud applications used at a CISO's company count as shadow apps, which are easy targets for cybercriminals, the survey revealed.

CISOs also tip open source software as a major concern this year, with 99% stating it will be bigger than last year.

Industry compliance issues may be going in the wrong direction

CISOs reported worries about a number of different industry compliance issues today, including:

  • Tracking of activities in sanctioned cloud applications (21 per cent);
  • country and region-specific data residency and control regulations (17 per cent);
  • broad sharing of compliance-controlled data in cloud applications (25 per cent);
  • governance of corporate-owned mobile devices (15 per cent); and
  • employee use of unsanctioned cloud applications (22 per cent)

So what are CISOs doing about it?

According to the survey, CISOs are looking for three key factors to support their security and policies for both data compliance and residency.

89% say they are looking for tokenisation as the best way to meet data residency and control; but only 61% currently use it. 88% use cloud encryption and only 51% use both.

General focus areas: More training, bigger budget, better protection

95% of Australian CISOs plan for more spending on staff training. New employees may average 20 hours of security training during the onboarding process - one of the longest training times out of all countries surveyed in the research..

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.