Cyber complacency is real

April 2018 Editor's Choice, Information Security

CA Southern Africa has announced that Veracode has released new research, revealing the widening gap between software creation and software security, with the rush to innovate outpacing the urgency to secure the process.

The ‘Securing the Digital Economy’ report highlights how investment in software and digital transformation is rapidly accelerating, with around one in five business leaders indicating that their software budget had increased 50 percent or more over the past three years to support digital transformation projects. However, the increased software development investment has not translated to greater security budgets or awareness of the security risks insecure software introduces: only 50 percent of business leaders surveyed understand the risk that vulnerable software poses to their business.

CA Veracode commissioned YouGov to survey 1403 business leaders across Britain (653), the US (506) and Germany (244) about their company’s digital transformation initiatives and understanding of cybersecurity. The polling was conducted online over a nine-day period between September 25 and October 4, 2017.

The report indicates that 25 percent of all business leaders surveyed in Britain and US report that they do not understand any of these common cybersecurity threats:

• Vulnerable software.

• Ransomware.

• Vulnerable open source components.

• Phishing attacks.

• Malicious employee activity.

• DDoS attacks.

Not aware of high-profile cyber-attacks

The lack of understanding around cyber risk may be attributed, in part, to a lack of awareness of successful cyber-attacks and their causes. Because business leaders are unaware of either the breaches themselves or the underlying causes, they are not compelled to learn about or defend against similar threats their company could face. For example:

• Despite being highly publicised and causing several high-level executives to lose their jobs and the ex-CEO being forced to testify to the US Congress, only five percent of all business leaders surveyed indicated the Equifax breach prompted them to rethink their current business’s approach to cybersecurity;

• Only one-third of business leaders surveyed had heard of the global WannaCry ransomware attack, although awareness was greater among British business leaders at 40 percent. Just one in 10 reported it led them to rethink their approach to cybersecurity;

• Fifteen percent of business leaders surveyed in Britain and 19 percent of German business leaders had not heard of any of the high-­profile cyberattacks listed in the survey, while just under half of all US, GB and German respondents reported cyberattacks have not led their current business to rethink or update their cybersecurity approach.

We are seeing some shift in awareness, of the 33 percent who indicated that a cyber-attack on another company had led their business to rethink its approach to cybersecurity, many have either taken steps to improve their software security or plan to over the next 12 months.

More than one-third (34 percent) have or will over the next 12 months, start scanning or already scan more regularly for vulnerabilities in software; while one-fifth either have or will set security thresholds for software built by third-party providers and for all commercial out-of-the-box applications (22 percent and 20 percent, respectively).

While there may be some shift in awareness, not all business leaders have woken up to the risks of the evolving cyber threat landscape. One-third of business leaders surveyed revealed that they plan to take no new steps to improve their organisations’ overall cybersecurity in the next 12 months.

“Digital transformation presents both massive opportunity to innovate and significant security risks, with 77 percent of applications having at least one vulnerability when first scanned, which could be exploited to inject ransomware or steal data,” says Jaco Greyling, chief technology officer, DevOps solutions, CA Southern Africa.

Many business leaders have yet to fully grasp the most common cyber threats to their business, nor are they keeping up with some of the most catastrophic cyber events of our time. We need to bridge this disconnect between business leaders and the cybersecurity threat: without greater awareness of the threats and what is needed to defend against them, their company could easily be the next headline.”

Executives will act when you talk about the personal risk

While high profile breaches do not in themselves prompt great change in behaviour, when confronted with the possibility of personal accountability in the event of a breach, executives are more likely to take action. More than a third of the business leaders surveyed said the personal risk to executives outstripped compliance as a driver for board members.

Articulating the potential brand damage for senior executives from a data breach and the risk to their job security, was recommended by 38 percent and 35 percent of business leaders surveyed, respectively, as a way to engage a board on cybersecurity, compared to just 29 percent who suggested that highlighting the potential fines of data protection regulations, like GDPR.

Download the Securing the Digital Economy report at https://info.veracode.com/securing-the-digital-economy-survey-report-resources.html, or view the report infographic at https://info.veracode.com/securing-the-digital-economy-infographic-resources.html.

For more information, contact CA Southern Africa, +27 (0)11 417 8594, [email protected]





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Winners of the 2025 Southern Africa OSPAs
Editor's Choice
The winners of the 2025 Southern Africa Outstanding Security Performance Awards (OSPAs) were revealed on Wednesday, 4th June, at Securex South Africa. Winners from all categories (except the Lifetime Achievement) will be featured in the second Global OSPAs set to take place in 2026.

Read more...
Deepfakes and digital trust
Editor's Choice
By securing the video right from the specific camera that captured it, there is no need to prove the chain of custody for the video, you can verify the authenticity at every step.

Read more...
A new generational framework
Editor's Choice Training & Education
Beyond Generation X, and Millennials, Dr Chris Blair discusses the seven decades of technological evolution and the generations they defined, from the 1960’s Mainframe Cohort, to the 2020’s AI Navigators.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
Key design considerations for a control room
Leaderware Editor's Choice Surveillance Training & Education
If you are designing or upgrading a control room, or even reviewing or auditing an existing control room, there are a number of design factors that one would need to consider.

Read more...
CCTV control room operator job description
Leaderware Editor's Choice Surveillance Training & Education
Control room operators are still critical components of security operations and will remain so for the foreseeable future, despite the advances of AI, which serves as a vital enhancement to the human operator.

Read more...
Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
A passport to offline backups
SMART Security Solutions Technews Publishing Editor's Choice Infrastructure Smart Home Automation
SMART Security Solutions tested a 6 TB WD My Passport and found it is much more than simply another portable hard drive when considering the free security software the company includes with the device.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.