Some 60 per cent of security professionals say spend on information security is not keeping pace with growing risk, according to the Institute of Information Security Professionals (IISP1) from its 2016 member survey2. With over 2500 members working in security across a range of industries and roles, including a significant proportion at Senior/Lead/CISO level, the results of the IISP provide a snapshot of the state of the UK cyber security landscape from those working on the front line, the association says. The survey suggests that for over two thirds of members, information security budgets have increased, while a further 15pc said that they had stayed the same. These are encouraging figures, the IISP says, but they have to be examined alongside increasing risk and the survey also found that 60pc of respondents felt that budgets were still not keeping pace with the rise in the level of threats. Only 7% reported they were rising faster than the level of threat.
Piers Wilson, Director at IISP, said: In times of financial pressure or instability as we have seen in recent years, security is often seen as a supporting function or an overhead. Security budgets are hard won because they are about protection against future issues, so are a good indication of the state of risk awareness in the wider business community. While it is good news that businesses are increasing investment, it is clear that spending on security is still not at a level that matches the changing threat landscape. The survey also found that when it comes to recruitment, there is still a skills shortage but the problem doesn t just lie in the number of people. Respondents point to a shortfall in the level of skills and experience, making staff training, development and retention crucial to the future of the industry.
The question: As an industry are we getting better or worse at defending systems from attack and protecting data? saw only 10pc thinking that protection is declining. With growing recognition that despite every control and safeguard, a determined attacker will always be able to find a chink in the armour, the survey looked at incident response. Some 49pc were reporting improvement. Overall, the results of the member survey show that there are growing challenges, the IISP says, from more types of attack, more sources of threats, greater reliance on increasingly complex IT systems, shortage of effective security staff and a regulatory environment that is both fluid and challenging.
However, the heightened awareness of security risks and the impacts of a breach are driving an increase in investment, skills, experience, education and professionalism.
References
- ^ IISP (www.iisp.org)
- ^ 2016 member survey (iisp.informz.net)