全球智库信息集成服务系统

Common Knowledge Confirmed

• Security postures are highly specific to company type, size, etc.; and there often aren't good solutions for smaller businesses.
• Quarantining certain parts of an organization offline can be a useful option.
• Responding to the desire of employees to bring their own devices and connect them to the network creates growing dilemmas.
• Chief information security officers (CISOs) feel that attackers have the upper hand, and will continue to have it.

Reasonable Suppositions Validated

• Customers look to extant tools for solutions even though they do not necessarily know what they need and are certain no magic wand exists.
• CISOs want information on the motives and methods of specific attackers, but there is no consensus on how such information could be used.
• Current cyberinsurance offerings are often seen as more hassle than benefit, only useful in specific scenarios, and providing little return.

Surprising Findings

• A cyberattack's effect on reputation (rather than more direct costs) is the biggest cause of concern for CISOs. The actual intellectual property or data that might be affected matters less than the fact that any intellectual property or data is at risk.
• In general, loss estimation processes are not particularly comprehensive.
• The ability to understand and articulate an organization's risk arising from network penetrations in a standard and consistent matter does not exist and will not exist for a long time.