Improving an organization’s security posture can be a daunting task. Conducted by Ponemon Institute and sponsored by ReliaQuest, the research reveals that security leaders are committed to being risk-oriented and strategic but lack the fundamentals needed to achieve this objective.

More than 1,000 security leaders were surveyed in the United States (632) and United Kingdom (391) who are familiar with the organizations’ security operations and strategy. Participants in this research are knowledgeable about their organizations’ efforts in attaining a risk-oriented security posture. Most respondents are involved in implementing solutions (61 percent) followed by evaluating solutions (48 percent). This report presents the consolidated US and UK research findings.

Senior leadership and the board of directors are ill-informed about security risks facing their organization.  Only 37 percent of respondents say they are tracking the right security metrics to be able to communicate risks easily and accurately to the business executives and board. As a result, only 31 percent of respondents say senior leadership and the board are tracking cybersecurity risk as a business risk.

Respondents are committed to a stronger risk-based security posture. Priorities for respondents are the ability to migrate applications to the cloud securely, implement an integration strategy to drive holistic visibility across security tools and develop metrics to align security and lines of business with the organizations’ business goals.

The following findings reveal why organizations are at risk and indicate the opportunities for improvement.

Risk management programs are not properly assessed and measured. Fifty-eight percent of respondents say their organizations lack a risk management strategy and decision-making structure in their organizations. As a result, another 58 percent of respondents say the number one reason they are vulnerable to a data breach is because their organizations lack a well-defined security and risk management program. Only 29 percent of respondents say the risk management program is assessed by lines of business and aggregated and reported across the entire organization.

There is a lack of visibility throughout the enterprise. Fifty-eight percent of respondents say it is difficult to protect business-critical assets because of the lack of visibility and blind spots in coverage. Sixty percent of respondents say their organizations lack integrated visibility into cloud and on-premises solutions. This is considered a significant obstacle to having effective threat detection and investigation practices.

Security teams find it difficult to achieve efficiencies in the detection, investigation and response to security incidents because of the numerous tools and technologies used. According to the research, there are too few people who are responsible for too many tools and technologies used for threat detection. According to the research, 46 percent of respondents say one staff member could be responsible for between 4 and 10 tools. Eleven percent say one staff member could be responsible for more than 10 tools. As a result, it can take an average of 18 hours, or more than two days, to detect, investigate and respond to a security incident.

Metrics used are not able to reveal the risk and support a risk-based management program. Sixty-four percent of respondents say there is a lack of standardized metrics to measure progress in the risk management program.  Only 36 percent of respondents say their organizations have visibility across the IT environment, including on-premises and cloud are measured.

Confidence in the security of the cloud is low. Less than one-third of respondents say they are confident in knowing all cloud computing applications, platforms or infrastructure services in use today. Sixty-two percent of respondents say coverage gaps and lack of visibility make it very difficult and complex to secure data and applications in a multi-cloud and hybrid environment.

Fifty-one percent of respondents say misconfigurations in cloud implementations make organizations vulnerable to a data breach. Only 19 percent of respondents say their organizations measure the lack of integration due to disparity of cloud environments.

To read the executive brief of this report, visit Reliaquest.com  

Hate pop-ups that interrupt your web browsing — and probably come with consequences you don’t fully understand? Well, there’s hope.

When Europe passed its ambitious law designed to protect consumer privacy, known as GDPR, many Internet users noticed only one impact — annoying pop-ups jammed with mini-privacy policies.  To any level-headed person, the small windows were an annoyance clearly designed to get in your way – and get a check in a box so companies could continue tracking your online travels. Consent spam, they have come to be called. Most users clicked click “agree” to get on with their day, effectively granting thousands of companies the ability to trade in intimate details of their digital lives.

A ruling by European regulators this week holds out the promise that consent spam and GDPR pop-ups will soon be gone. And so too could be gigantic databases of user information collected using this method, including giants like Microsoft and Google.

When GDPR – Europe’s General Data Protection Regulation — took effect, advertisers had to come up with a way to get user consent for data collection. The industry came up with something called the “Transparency & Consent Framework (TCF),” managed by the online advertising industry’s trade body, known as IAB Europe.  In order to prevent a massive disruption in the background magic which matches ad buyers to users several billions of times per day — a system known as real-time bidding — IAB Europe invented the system we now know as consent spam.

The pop-ups were a source of user frustration, but more critically, much sarcasm.  U.S. critics have been fond of saying GDPR made life even worse for Netizens, adding annoyance while hardly protecting their privacy.

That’s why this week’s ruling is significant to policy-makers and users alike.

Johnny Ryan, a fellow at the Irish Council for Civil Liberties and a principal complainant in the case, wrote on Twitter that the “popups were not a symptom of the law, but of the tracking industry attempt to undermine the law.” EU regulators now agree with him.

Belgian’s Data Protection Authority ruled this week that the pop-ups violated the spirit and the letter of the GDPR — Europe’s General Data Protection Regulation. The authority found: The consent spam fails to provide real transparency about what happens to user data; fails to ensure the data is kept secure and confidential; and fails to properly request consent.

In a statement, the ICCL said that the popups support “a system posing great risks to the fundamental rights and freedoms of the data subjects, in particular in view of the large scale of personal data involved, the profiling activities, the prediction of behavior, and the ensuing surveillance of data subjects.”

IAB Europe was fined and ordered to come up with a plan to fix its system within two months. Perhaps more important: data collected through the system must now be deleted.

When I interviewed Ryan for a podcast recently, he called real-time bidding the largest data breach of all time.  The legal finding could be very expensive for Big Tech: The ICCL says that it means “All data collected through the TCF must now be deleted by the more than 1,000 companies that pay IAB Europe to use the TCF. This includes Google’s, Amazon’s and Microsoft’s online advertising businesses.”

“This has been a long battle”, Ryan said. “Today’s decision frees hundreds of millions of Europeans from consent spam, and the deeper hazard that their most intimate online activities will be passed around by thousands of companies”.

Indeed, privacy rulings take a long time.  The consent framework was originally found to be in violation of the GDPR back in October 2020.

IAB Europe has 30 days to appeal this latest ruling, which was supported by 27 other European privacy commissioners.

“We believe this finding is wrong in law and will have major unintended negative consequences going well beyond the digital advertising industry,” the IAB said. “We are considering all options with respect to a legal challenge.”

Just when might consumers start seeing fewer popups in their clickstreams? Or when might they learn their personal information, collected improperly, has been deleted? That remains to be seen. Chris Olson, CEO and founder of The Media Trust, wasn’t terribly optimistic that change would come quickly.  For starters, he’s worried the role of pop-ups might even expand as publishers try to lawyer their way into compliance with this ruling.  Also, much of the data that has been declared illegally collected has already been onpassed over and over, making it impractical to delete from the larger data collection ecosystem.

Here’s what he told me:

“With the Belgian Court’s judgment against the IAB TCF, what was once a matter of debate is now beyond dispute: the concept of CMPs does not meet the standards or spirit demanded by emerging data privacy legislation. In the long run, however, this ruling may prove to be a pyrrhic victory. First of all, users will not see consent pop-ups disappearing any time soon. The IAB has six months to revise its framework, and when it is finished, pop-ups may become even more unwieldy in the struggle to provide users with ‘sufficiently specific’ information.

“Second – while we expect big players to minimally comply with the TCF’s data deletion orders – in many cases it will be impossible to distinguish data that was gathered illegally from data that was obtained by legitimate means, and not always by accident. In all likelihood, much of the data collected under the TCF before this week will remain on the books, integrated into customer profiles, CRM and marking tools, etc. More concerning, advertisers and publishers won’t be able to control any data gathered by digital third parties without their permission.

“Today, the biggest risk to users’ data privacy does not come from advertisers who are struggling – however unsuccessfully – to comply with GDPR: it comes from unregulated vendors who neither seek consent, nor respect it. Until now, third parties have been an afterthought in most data privacy legislation, if they are even mentioned at all. Going forward, they must become a key part of the push to assure consumers of digital safety and trust.”

Meanwhile, for more: Ryan’s Twitter thread makes the ruling easy to digest

If you are more ambitious, you can read the full decision here.