Amid an IT talent shortage in an ever-evolving cyberthreat landscape, businesses and hospitals often make investment mistakes when it comes to cybersecurity, according to a joint Information Systems Security Association and Enterprise Strategy Group report released Wednesday.
The report curated responses from 343 information security professionals representing organizations of all sizes from multiple industry sectors around the world.
Here are the top five cybersecurity investment mistakes and solutions businesses make.
1. Not aligning cybersecurity and business goals. Respondents suggest adding concrete goals and identifying set metrics for both IT and business management.
2. Not building repeatable processes. According to respondents, one of the top two cybersecurity challenges is having too many manual and informal processes for cybersecurity. But, they believe organizations can benefit from documenting and formalizing these processes.
3. Not investing in training. Despite increased investments in cybersecurity, respondents do not believe organizations are allocating their cybersecurity budgets effectively. They suggest organizations invest in more training at all levels — from non-technical employees to executive management.
4. Not providing the right training. Because respondents often turn to specific courses and professional development organizations for cybersecurity training, organizations should employ more sophisticated programs to ensure their employees' cyber skills are up to date.
5. Not assuming a perpetual skills shortage in future planning and strategy. Respondents identified understaffing as the No. 1 cybersecurity challenge facing their organization. They recommend organizations implement aggressive IT recruiting programs to help fill these skill gaps.
More articles on cybersecurity:
IU Health's hospital finds lost patient billing paperwork on street
Employee wrongdoing at Valley Family Medical exposes data on 8.5k patients