{"id":27870,"date":"2017-03-01T17:01:02","date_gmt":"2017-03-01T09:01:02","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=27870"},"modified":"2017-03-01T17:01:02","modified_gmt":"2017-03-01T09:01:02","slug":"report-finds-misaligned-incentives-executive-overconfidence-create-advantages-for-attackers","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2017\/03\/01\/report-finds-misaligned-incentives-executive-overconfidence-create-advantages-for-attackers\/","title":{"rendered":"Report finds misaligned incentives, executive overconfidence create advantages for attackers"},"content":{"rendered":"

Intel Security, in partnership with the Center for Strategic and International Studies (CSIS), released \u201cTilting the Playing Field: How Misaligned Incentives Work Against Cybersecurity,\u201d a global report and survey revealing three categories of misaligned incentives: corporate structures versus the free flow of criminal enterprises; strategy versus implementation; and senior executives versus those in implementation roles. The report highlights ways organizations can learn from cybercriminals to correct these misalignments.<\/strong><\/p>\n

\"\"<\/a><\/p>\n

Based on interviews and a global survey of 800 cybersecurity professionals from five industry sectors, the report outlines how cybercriminals have the advantage, thanks to the incentives for cybercrime creating a big business in a fluid and dynamic marketplace. Defenders on the other hand, often operate in bureaucratic hierarchies, making them hard-pressed to keep up.<\/p>\n

Additional misalignments occur within defenders\u2019 organizations. For instance, while more than 90 percent of organizations report having a cybersecurity strategy, less than half have fully implemented them. Moreover, 83 percent say their organizations have been affected by cybersecurity breaches, indicating a disconnect between strategy and implementation.<\/p>\n

And while cybercriminals have a direct incentive for their work, the survey not only shows there are few incentives for cybersecurity professionals, but that executives are much more confident than operational staff about the effectiveness of the existing incentives. For example, 42 percent of cybersecurity implementers report that no incentives exist, compared to only 18 percent of decision-makers and eight percent of leaders.<\/p>\n

\u201cThe cybercriminal market is primed for success by its very structure, which rapidly rewards innovation and promotes sharing of the best tools,\u201d said Candace Worley, Vice President of Enterprise Solutions for Intel Security. \u201cFor IT and cyber professionals in government and business to compete with attackers, they need to be as nimble and agile as the criminals they seek to apprehend, and provide incentives that IT staff value.\u201d<\/p>\n

\u201cIt\u2019s easy to come up with a strategy, but execution is tough,\u201d said Denise Zheng, director and senior fellow, technology policy program at CSIS. \u201cHow governments and companies address their misaligned incentives will dictate the effectiveness of their cybersecurity programs. It\u2019s not a matter of \u2018what\u2019 needs to be done, but rather determining \u2018why\u2019 it\u2019s not getting done, and \u2018how\u2019 to do it better.\u201d<\/p>\n

Other key findings of the report include the following:<\/p>\n