Story image

Australian CISOs say cloud compliance is one of the most stressful parts of the job

04 Jul 17

The task of making sure cloud applications follow compliance policies is one of the most stressful areas of a chief information security officer's (CISO's) job, and they also believe their CEOs are undermining internet security protocols.

Those are the sentiments from Symantec's latest research, which suggests that there are gaping areas in both their organisation's security and the people involved in implementing it.

74% of Australian CISOs believe that their CEO has broken internal security protocols, whether intentionally or unintentionally.

86% say that making sure cloud applications are in line with compliance protocols is the most stressful part of their jobs, but that isn't all they are concerned about.

Hijacking threats top-of-mind for Australian CISOs

32% of CISOs believe account hijacking may become a top threat this year; followed by data breaches (30%); exploited system vulnerabilities (19%); hacked APIs (12%); and broken authentication and compromised credentials (7%).

When looking specifically at cloud security, data loss; staff non-compliance; training; and insecure business applications topped the list of the biggest threats this year. 91% believe that regular data backups cannot work on their own to stop attacks and malware.

29% of cloud applications used at a CISO's company count as shadow apps, which are easy targets for cybercriminals, the survey revealed.

CISOs also tip open source software as a major concern this year, with 99% stating it will be bigger than last year.

Industry compliance issues may be going in the wrong direction

CISOs reported worries about a number of different industry compliance issues today, including:

  • Tracking of activities in sanctioned cloud applications (21 per cent);
  • country and region-specific data residency and control regulations (17 per cent);
  • broad sharing of compliance-controlled data in cloud applications (25 per cent);
  • governance of corporate-owned mobile devices (15 per cent); and
  • employee use of unsanctioned cloud applications (22 per cent)

So what are CISOs doing about it?

According to the survey, CISOs are looking for three key factors to support their security and policies for both data compliance and residency.

89% say they are looking for tokenisation as the best way to meet data residency and control; but only 61% currently use it. 88% use cloud encryption and only 51% use both.

General focus areas: More training, bigger budget, better protection

95% of Australian CISOs plan for more spending on staff training. New employees may average 20 hours of security training during the onboarding process - one of the longest training times out of all countries surveyed in the research..

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.
Huawei founder publically denies spying allegations
“After all the evidence is made public, we will rely on the justice system.”