High-profile GDPR fines “having greatest impact” on UK cyber security spend

Research conducted by data security company Clearswift has highlighted that the recent large General Data Protection Regulation (GDPR)-centric fines levied against enterprise giants British Airways (BA) and Marriott International have had something of a ripple effect on Board-level involvement and spending plans in relation to cyber security within UK financial sector firms.

The research, which surveyed senior business decision-makers within enterprise financial organisations in the UK, highlights the Information Commissioner’s Office’s (ICO) recent judgements on BA and Marriott International as a key turning point when it comes to addressing cyber security. Almost one-third of companies (32%) referenced these recent GDPR fines as being the primary reason for an increase in Board-level involvement and/or provision for IT security spending. 

“It has been over a year since the GDPR has been enforced and organisations were wondering if there were any teeth behind the regulations,” said Dr Guy Bunker, CTO at Clearswift. “These fines have clearly sent shockwaves into the industry and are now serving as a blueprint for how the ICO will handle cases of this nature. By giving out such large ‘intentions to fine’ notices, the ICO has delivered a strong message that it’s not afraid to reprimand household names.” 

Bunker added: “Boards of Directors are now sitting up and taking notice of GDPR compliance and the role cyber security plays in it. However, it’s not just about taking notice. It’s also about the need to invest to maximise their ability to keep the organisation safe from new threats. Revisiting their ‘defence in depth’ strategy to augment with enhanced security solutions including both the boundary and the cloud, and implementing more stringent policies, is going to be critical for securing the critical information they hold within the organisation.”

Supply chain threats and ransomware

Other key threats identified by respondents included supply chain threats (25%), whereby attackers seek to damage an organisation by targeting less-secure elements in the supply network. Ransomware attacks (24%), such as the infamous WannaCry episode in 2017 (where malicious software denies access to a computer system or critical data until a ransom is paid) also figured highly on the list.

Interestingly, when looking solely at companies with over 5,000 employees, the fear of ransomware was perceived to be the key reason why firms are bolstering their spending. This isn’t surprising when you consider firms infected with ransomware have, in some cases, ended up reverting to pen and paper until back up-and-running again.

When asked about spending levels, the majority of financial businesses would like to see an increase in cyber security investment (73%), with almost one-in-five (17%) UK firms surveyed reporting that their budgets currently stood ‘well below the adequate level’. Fortunately, this figure dropped dramatically (to 5%, in fact) when looking at firms with over 5,000 employees. This is a possible sign that larger firms have already made additional investment to deal with the ever-changing cyber ‘threatscape’.

Focus for investment

When asked where their organisation currently focuses its cyber security investment, data loss prevention technology is a primary area for over half (53%) of UK financial businesses, followed by database security (42%), regulatory compliance (40%) and advanced threat protection (40%).

Bunker also said: “Increasing investment in the latest data loss prevention solutions will help mitigate inadvertent and malicious data loss risks. Furthermore, with the GDPR, organisations need to be aware that receiving unauthorised data can cause issues. They need to better understand how information flows through the organisation in order to tailor security solutions around how the business operates. In doing so, it will highlight where the biggest risks are and how the most cost-effective solutions can be deployed to increase protection and prevent a hefty fine.”

About the Author
Brian Sims BA (Hons) Hon FSyI, Editor, Risk UK (Pro-Activ Publications) Beginning his career in professional journalism at The Builder Group in March 1992, Brian was appointed Editor of Security Management Today in November 2000 having spent eight years in engineering journalism across two titles: Building Services Journal and Light & Lighting. In 2005, Brian received the BSIA Chairman’s Award for Promoting The Security Industry and, a year later, the Skills for Security Special Award for an Outstanding Contribution to the Security Business Sector. In 2008, Brian was The Security Institute’s nomination for the Association of Security Consultants’ highly prestigious Imbert Prize and, in 2013, was a nominated finalist for the Institute's George van Schalkwyk Award. An Honorary Fellow of The Security Institute, Brian serves as a Judge for the BSIA’s Security Personnel of the Year Awards and the Securitas Good Customer Award. Between 2008 and 2014, Brian pioneered the use of digital media across the security sector, including webinars and Audio Shows. Brian’s actively involved in 50-plus security groups on LinkedIn and hosts the popular Risk UK Twitter site. Brian is a frequent speaker on the conference circuit. He has organised and chaired conference programmes for both IFSEC International and ASIS International and has been published in the national media. Brian was appointed Editor of Risk UK at Pro-Activ Publications in July 2014 and as Editor of The Paper (Pro-Activ Publications' dedicated business newspaper for security professionals) in September 2015. Brian was appointed Editor of Risk Xtra at Pro-Activ Publications in May 2018.

Related Posts