Growing numbers of chief audit executives are introducing security operation centres in the face of the growing risks from cyber incidents and data breaches, according to research conducted by the Institute of Internal Auditors’ (IIA) and Crowe Horwath, which suggests a new focus on taking the offensive against potential attacks
A global survey of chief audit executives found that that more than a third of respondents are turning to security operation centres, both formal and informal, as part of their cybersecurity strategies.
Richard Chambers, IIA president and CEO, said: ‘It is logical and encouraging that models to address the pervasive and potentially devastating threat of cyberattacks are evolving. The creation of formal security operation centres allows for holistic, proactive approaches to cybersecurity in which all parts of the organization, including the internal audit function, can support the battle against data breaches.’
The interviews confirmed a growing number of organisations recognize that ‘100% protection 100% of the time’ is not achievable. It is then that an organisation’s cybersecurity strategies can ‘shift from a defensive posture to a more offensive and proactive one that focuses on learning about how certain threats operate, how their effects can be limited or mitigated, and how the incident response time (from identification to remediation) can be accelerated,’ according to the report’s findings.
Raj Chaudhary, Crowe risk consulting principal, said: ‘There is room for internal audit to get more engaged in the evaluation of security operations. Over time, advanced analytics capabilities will allow companies to become more proactive in preventing events that could negatively impact business operations.’
The IIA report, Next Steps: Beyond Response to Anticipation, is here.
