Bangalore-based CISO Platform, an online social collaboration platform for senior IT Security Professionals, has launched India’s 1st formal report on the IT Security maturity of the industry, based on data from 400+ organizations.
Speaking on the launch of the report on Aug 5, 2015, Ms. Priyanka Aash, MD, CISO Platform said, “We have an index for understanding the state of the stock market, but there is nothing to measure the state of IT Security of the industry. We need something simple and understandable to know where we stand in terms of security posture. So, we have created CISO Platform Security Maturity Model (CPSMM) to solve this problem”
CISO Platform has collected the data point of more than 400 companies in terms of the technologies adopted for securing their organizations over the last three years. Using Data Science, a formal model was built for computing maturity index. Each technology has been assigned a specific weight based on the importance. CISO Platform measured the capability maturity for each organization based on the above formula and also created average maturity index for various industry verticals. CPSMM is built to benchmark an organization against the capability of peers, so that one can understand if an organization is falling behind or is in pace with the rest of the industry. The model is particularly useful for the Board and the senior management so that they can have a data driven way to measure their security readiness, as well as create their strategic roadmap.
Key insights from the report
The sample data point in the report comprises of top 400 enterprises. Small and Medium sized organizations are not included in the sample.
India vs. Globe
• Indian Enterprises are more than 80 per cent at par with the USA in terms of adoption of Prevention or Detection technologies. However, they are less than 10 per cent at par for Response and Predictive Technologies. In the field of IT security, it is impossible to secure everything, every time. So it is extremely critical to have effective measures to respond to a breach or predict a breach before it happens. India is far behind USA in terms of such readiness and capabilities like Incident response, Threat intelligence etc.
• India is far behind in hiring IT Security Staff when compared globally: Average IT Security team size as a percentage to overall IT staff is less than one per cent for all verticals in India, whereas recommended figure globally is 3-5 per cent.
• Maturity of India for one of the most trending security initiative i.e. Mobile Security is 35 per cent whereas in US its almost 50 per cent.
• Indian companies are not prepared for large scale Distributed Denial of Service (DDOS) attacks. Adoption of DDOS technologies is less than 50 per cent compared to USA.
Vertical Wise Maturity
• The security maturity Index for Large Scale Telecom emerged as the highest, with a score of 76.62 (out of 100). Major IT/ITES stood 2nd with 74.66, followed by Major BFSI (Banking and Financial Services) with score of 70.16.
• The score for other major industry verticals are as follows: Financial Services (56.06), healthcare (53.13), Manufacturing (52.43).
• Smaller BFSI emerged as the least secured vertical and has achieved a score of 44.95. Online and retails achieved a score of 51.52 is the second from the bottom.
Technology Adoption
• With 56 per cent companies planning to implement Mobile Security this year, it tops the IT security initiative of the year; IT GRC Management Tools bagged second rank with 50 per cent and DRM ranked 3rd position with 40 per cent.
• Top 3 Mature Security Markets: Anti-spam/Anti-malware (98 per cent implementation), Content Security (93 per cent implementation) and Patch Management (87 per cent implementation) are top 3 Mature IT Security market in 2015.
• IT Security Budget figure is better than Global Figure: According to CISO Platform: “IT Security budget in India ranges from 12-19 per cent whereas global figure ranges from 5-14 per cent”.
• More than half of the companies in the sample data set, tested their IT security infrastructure once in a quarter. However the Indian Industry is highly price sensitive and often compromises on quality.
• ISO 27001 tops the security compliance with 66 per cent implementation by the companies in India across all verticals.
State of Online/Ecommerce Security
• Online and Ecommerce companies rank the second lowest, with a score of 51.52 compared to the Large Scale telecom companies with a maturity of 76.62.
• Online and Ecommerce companies lack in terms of IT Security maturity and most of the companies do not have adequate protection against DDOS attacks or a well tested Incident Response Program. Most of the young ecommerce companies also lack in key security requirements like Secure SDLC, In Depth Penetration Testing during every release, Web Application Firewall (WAF), SIEM etc.
• More than 90 per cent of the ecommerce companies do not have a dedicated Chief Information Security Officer and typically their engineering head doubles up as the IT Security Head.
Biggest Risks for the Indian Industry
• There is severe lack of awareness in terms of IT Security across all levels of the organization. The Board/CEO in a usual company does not consider Security as a top priority. The IT Security teams are generally not trained in emerging areas of security. India is at least 10 times behind USA in terms of adopting emerging IT Security technologies like CASB, Threat Intel and Containerization etc.
• There is a lack of indigenous IT Security technology companies from India. India has produced less than 25 indigenous IT security product companies compared to more than 500 in USA. As a nation, we need to allocate more resources towards building security technologies.
fii-news.com
