March 28, 2017 By Mark Samuels 2 min read

Most executives recognize the growing threat posed by cyberattacks, but few business leaders are putting the security strategy in place to help keep enterprise information safe and secure.

Although 94 percent of U.K. companies think the security of their IT systems is important, almost half (45 percent) do not have a formal security strategy in place, according to research from the Institute of Directors (IoD) and Barclays Bank.

The results of the survey raised concerns given the context of ever-increasing external threats and new legislative requirements, particularly the European Union’s General Data Protection Regulation (GDPR). IT decision-makers must ensure their business pays attention to policies and processes that can help reduce the risk of data exposure in light of these happenings.

Understanding the Need for Action

The research, which polled almost 1,000 business leaders, highlighted a general lack of preparedness among U.K. executives. Just one-third of business leaders use virtual private networks to help secure mobile communications, and only about half are familiar with two-factor authentication.

Education is another problem area for U.K. organizations. Just 44 percent have launched some kind of cyber awareness training. The report also found many organizations leave gaps of more than a year between running these training programs.

Even more troubling is the fact that as many as 40 percent of business leaders would not know who to contact to report online fraud. This lack of preparation and knowledge is a significant concern because of cybersecurity incidents during the past year and further legislative changes associated to the forthcoming GDPR.

Preparing for New Regulations

The GDPR is a new data protection framework that takes effect across Europe starting May 2018. It will expand the level of accountability organizations have for data breaches, and business leaders have to adhere to and prove they follow the principles of the framework.

All organizations will need to report data breaches to a supervisory authority within 72 hours and then to any affected individuals, explained Infosecurity Magazine. Failure to do so under the GDPR could result in fines of anything up to 10 million pounds or 2 percent of a firm’s global turnover.

These new regulations present a significant challenge to all businesses. And any lack of preparedness in terms of security strategies demonstrates how executives must start to formalize their policies and procedures.

Building a Better Security Strategy

In a news release, the IoD urged business leaders to step up their preparations for the GDPR now. It also advised that all directors and board members should be trained about the importance of a security strategy.

Additional research suggested the lack of preparation for GDPR stretches to other line-of-business departments beyond IT. About one-quarter of marketers believe their companies are unprepared, Marketing Week reported. Additionally, one-third do not expect to be compliant when the law comes into effect.

IT decision-makers and their C-suite peers should turn their attention to several key areas, including a thorough assessment of their organizational data and security audits to ensure any implemented security strategy is of the highest possible standard.

More from

SoaPy: Stealthy enumeration of Active Directory environments through ADWS

10 min read - Introduction Over time, both targeted and large-scale enumeration of Active Directory (AD) environments have become increasingly detected due to modern defensive solutions. During our internship at X-Force Red this past summer, we noticed FalconForce’s SOAPHound was becoming popular for enumerating Active Directory environments. This tool brought a new perspective to Active Directory enumeration by performing collection via Active Directory Web Services (ADWS) instead of directly through Lightweight Directory Access Protocol (LDAP) as other AD enumeration tools had in the past.…

Smoltalk: RCE in open source agents

26 min read - Big shoutout to Hugging Face and the smolagents team for their cooperation and quick turnaround for a fix! Introduction Recently, I have been working on a side project to automate some pentest reconnaissance with AI agents. Just after I started this project, Hugging Face announced the release of smolagents, a lightweight framework for building AI agents that implements the methodology described in the ReAct paper, emphasizing reasoning through iterative decision-making. Interestingly, smolagents enables agents to reason and act by generating…

4 ways to bring cybersecurity into your community

4 min read - It’s easy to focus on technology when talking about cybersecurity. However, the best prevention measures rely on the education of those who use technology. Organizations training their employees is the first step. But the industry needs to expand the concept of a culture of cybersecurity and take it from where it currently stands as an organizational responsibility to a global perspective.When every person who uses technology — for work, personal use and school — views cybersecurity as their responsibility, it…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today