Not even one in three cybersecurity professionals views their organization's cybersecurity culture as better than average, according to a new survey.
That leaves plenty of room for improvement, concluded "The Life and Times of Cybersecurity Professionals." Now in its eighth year, the annual study conducted by the Information Systems Security Association (ISSA) and Omdia, a division of Informa TechTarget, gauged the opinions of 380 IT and security professionals about a variety of topics, ranging from job satisfaction to the quality of the work being done by their own teams.
When asked to grade their organization's cybersecurity culture, only 29% rated it advanced, 50% called it average and 19% described it as fair.
What did cybersecurity professionals say would improve the state of security at their organizations? At the top of the list was a preference for increased training for cybersecurity and IT staff (42%), followed by investment in staff and tools (37%).
Other actions included improved governance and compliance (36%); better cyber hygiene (35%); better security culture across the organization (34%); more security awareness training for nontechnical employees (33%); better capabilities to prevent, detect and respond to threats (31%); and more frequent testing to validate controls and identify weaknesses (30%).
As for how to improve the working relationship between security and IT teams, 44% of respondents suggested embedding cybersecurity staff into functional technology groups, while 41% wanted automated processes that would require collaboration between security staff and their IT colleagues.
Wanting greater collaboration across an organization is one thing. Achieving it is something else. That's where capable leadership and soft skills come into play, said Melinda Marks, cybersecurity practice director at Omdia.
"Things like demanding a seat at the table when there are technology decisions being made. They should be saying, 'Hey, I want to look at the security features and weigh in on this and whether we should adopt this,'" said Marks, author of the Life and Times report. "Those take a lot of soft skills -- like communication and collaborating with the other teams -- that are different from just the technical skills in cybersecurity."
Organizations with a healthy cybersecurity culture have security leaders and teams that are willing to find ways to avoid the "Team of No" impulse to dismiss every new idea as unsafe, Marks said.
Successful companies also have constructive conversations about balancing risk and innovation, Marks said. "It's worth the investment for organizations that want to grow and scale to find those cybersecurity professionals who understand new technologies and know how to work with other teams to align on goals, put the right programs in place, put the right tools in place and then work to meet their goals. Those are different skills than in the past."
Marks also noted that effective security requires employers to address the ongoing pressures their security teams face. The survey's job satisfaction scores were not good, with 20% of respondents saying they regularly consider leaving the profession.
Companies need to pay more attention to this, Marks said, by investing in technologies as well as in the people who use them.
Shawn Murray, distinguished fellow and past president of ISSA, said burnout is best solved by those at the very top of an organization. "If leadership doesn't believe in or prioritize security as a requirement for conducting business, it continues to be a struggle for the cybersecurity professional -- especially for CISOs when you're trying to negotiate budgets and get personnel in."
Addressing burnout is a perennial problem that Murray said the industry has not been able to solve. Where he does see progress, however, is with CISOs being seen and heard by senior leadership and board members.
"It's easier to get in front of the board today if you're a CISO," Murray said, adding that an encouraging trend is that a growing number of CISOs report directly to a CEO rather than a CTO or CIO.
Phil Sweeney is an industry editor and writer focused on cybersecurity topics.
