Global organizations better prepared to predict and resist cyber attacks, but struggle to recover from them, EY survey finds - Seite 2

"Organizations have come a long way in preparing for a cyber breech, but as fast as they improve, cyber attackers come up with new tricks. Organizations therefore need to sharpen their senses and upgrade their resistance to attacks. They also need to think beyond just protection and security to 'cyber resilience' – an organization-wide response that helps them prepare for and fully address these inevitable cybersecurity incidents. In the event of an attack they need to have a plan and be prepared to repair the damage quickly and get the organization back on its feet. If not, they put their customers, employees, vendors and ultimately their own future, at risk."

Business continuity and disaster recovery – which is at the heart of an organization's ability to react to an attack – was rated by respondents as their top priority (57%), along with data leakage and data loss prevention (57%). Although 42% plan to spend more this year on data leakage and loss prevention, only 39% plan to spend more on business continuity and disaster recovery.

Further vulnerabilities and obstacles remain

This year's survey also shows that respondents continue to cite the same key areas of concern for their cybersecurity, such as the increased risks from the actions of careless or unaware employees (55% compared with 44% in 2015) and unauthorized access to data (54% compared with 32% in 2015). Meanwhile obstacles to their information security function are virtually unchanged from last year, including:

• Budget constraints (61% compared with 62% in 2015)
  
  
• Lack of skilled resources (56% compared with 57% in 2015)
  
  
• Lack of executive awareness or support (32%, the same as in 2015)

The digital ecosystem and connected devices pose challenges

Despite the connected nature of today's digital ecosystem, the survey found that 62% of global organizations said it was unlikely they would increase their cybersecurity spending after a breach that did not appear to do any harm to their operations. Also, 58% said it was unlikely they would increase their information security spending if a competitor was attacked, while 68% said it was unlikely they would increase their information security spending if a supplier was attacked. In the event of an attack that definitely compromised data almost half of the respondents (48%) would not notify customers who had been impacted within the first week. Overall, 42% of respondents do not have an agreed communications strategy or plan in place in the event of a significant attack.