IT Priorities 2019: Cyber security and risk management among top priorities for 2019

Shifting security priorities

While security remains a key area of focus, the survey shows there has been a shift in priorities in the past year, with data loss prevention (DLP) falling from top priority in 2018 to fifth in this year’s rankings, with just 26% of EMEA respondents planning to implement DLP compared with 55% a year ago.

Topping the EMEA security initiative rankings in 2019 is email security (28%), followed by identity and access management (27%) and user security training (27%). This shift in focus shows and increased recognition of the fact that email continues to represent one of the top ways cyber attackers are compromising enterprise security and the continued importance of employees as an organisation’s first line of cyber defence.

Email continues to be a top means of initiating cyber attacks, with new detection bypass techniques and executive impersonation capabilities continually emerging, recent FireEye research shows. In 2018, the FBI estimated that scams resulting from business email compromise, such as fake invoices and wire fraud, had cost businesses $12bn globally since 2013, underlining that email security should remain a priority for organisations seeking to improve their security posture.

As security systems and basic defences at the operating system level have improved, cyber attackers have increased efforts to trick employees into clicking malicious links through various forms of social engineering, underlining the importance of employee education to ensure they understand the threats their organisation faces and the role they can play in keeping it safe.

While email security comes in as the third highest priority in the UK, organisations are demonstrating a higher level of maturity than the region as a whole by focusing on user security training, cited as a priority by 32% of UK organisations polled, followed by encryption (31%) and email security (30%).

Multifactor authentication is also at 30%, compared with just 18% at across EMEA, despite the importance of MFA being highlighted with each high-profile data breach.  

Every company, regardless of size – from the smallest to the largest enterprise – should adopt MFA in 2019, according to Corey Nachreiner, chief technology officer at WatchGuard Technologies.

“This definitely should happen for their own protection, but I suspect there will be many laggards, despite the fact that today’s MFA solutions are much easier and less expensive,” he told Computer Weekly.

It is encouraging that encryption is a priority for 30% of UK organisations and 26% across the EMEA region as a whole, but this is down from 52% across EMEA a year ago, and other research indicates that while there has been a focus on encryption in the recent past, many businesses are still not applying common encryption tools effectively to contain the fallout and costs of data breaches, which suggests a lack of maturity in deployment.

Unsurprisingly, identity and access management (IAM) remains a top priority, ranked at number two across EMEA, but with only 27% of respondents planning initiatives in this area in 2019 and just 25% in the UK, indications are that most organisations addressed this as a priority as part of their GDPR preparation, with 42% of European organisations indicating they planned to invest in IAM in 2018.

Security budgets expected to rise

While the biggest IT budget increases across EMEA are expected to go to cloud computing and software, with 42% of respondents expecting increases in these areas, it is noteworthy that 39% of respondents expect security budgets to increase.

The strongest indicator that security really is rising up the priority list is the fact that more EMEA respondents are expecting budget increases in security than traditionally high-budget areas such as staff (29%), networking (28%), maintenance and support (24%) and consulting services (23%).

Increasing IT security budgets is consistent with a trend identified by a Thales report in mid-2018, which found that 69% of UK organisations reported an overall increase in their IT security spending, as did 75% of businesses in Sweden and 76% in Germany.

The fact that the percentage of organisations planning to invest in the various security-related technologies is fairly evenly spread for the year ahead indicates that rather than any particular area of focus, organisations are allocating security budgets across a range of initiatives in an effort to raise their cyber defence capabilities across the board and invest in a defence-in-depth strategy rather than betting on any single technology or group of technologies.

In addition to email security, identity and access management, user training and encryption, other security initiatives by EMEA organisations include data loss prevention, endpoint security, web security and threat detection.

In line with the trend of developing a comprehensive cyber defence capability, it is interesting to note that investments continue in areas such as application security in recognition of the fact that attackers are focusing on the application layer, and mobile device security and cloud security services in recognition that these new technology areas potentially present opportunities for attackers.