PwC is warning that organisations worldwide are failing to prepare effectively for cyberattacks and that many still struggle to comprehend and manage emerging cyber risks in an increasingly complex digital society.

The warning comes with the publication of  PwC’s 2018 Global State of Information Security® Survey (GSISS), based on responses of more than 9,500 senior business and technology executives from 122 countries.

Executives worldwide acknowledge the increasingly high stakes of cyber insecurity. Forty percent of survey respondents cite the disruption of operations as the biggest consequence of a cyberattack, followed by the compromise of sensitive data (39%), harm to product quality (32%), and harm to human life (22%).

When cyberattacks occur, most victimised companies say they cannot clearly identify the culprits. Only 39% of survey respondents say they are very confident in their attribution capabilities.

However, despite this awareness, many companies at risk of cyberattacks remain unprepared to deal with them. Forty-four percent say they do not have an overall information security strategy. Forty-eight percent say they do not have an employee security awareness training programme, and 54% say they do not have an incident-response process.

How cyber interdependence drives global risk

Case studies of non-cyber disasters have shown that cascading events often begin with the loss of power, according to PwC — and many systems are impacted instantaneously or within one day, meaning there is generally precious little time to address the initial problem before it cascades.

 Interdependencies between critical and non-critical networks often go unnoticed until trouble strikes. Many people worldwide—particularly in Japan, the United States, Germany, the United Kingdom and South Korea—are concerned about cyberattacks from other countries.

Tools for conducting cyberattacks are proliferating worldwide. Smaller nations are aiming to develop capabilities like those used by larger countries, while the leaking of US National Security Agency (NSA) hacking tools has made highly sophisticated capabilities available to malicious hackers.

Lack of cyber security is rising threat to critical infrastructure

PwC is also warning that the soaring production of insecure internet-of-things (IoT) devices is creating widespread cybersecurity vulnerabilities. Rising threats to data integrity could undermine trusted systems and cause physical harm by damaging critical infrastructure, the report says.

In May 2017, G-7 leaders pledged to work together and with other partners to tackle cyberattacks and mitigate their impact on critical infrastructure and society. Two months later, G-20 leaders reiterated the need for cybersecurity and trust in digital technologies. The task ahead is huge, PwC says.

Next steps for business leaders

PwC is recommending three key areas of focus for business leaders to prepare effectively for cyberattacks:

• C-suites must lead the charge and boards must be engaged: Senior leaders driving the business must take ownership of building cyber resilience. Setting a top-down strategy to manage cyber and privacy risks across the enterprise is essential.
• Pursue resilience as a path to rewards—not merely to avoid risk: Achieving greater risk resilience is a pathway to stronger, long-term economic performance.
• Purposefully collaborate and leverage lessons learned: Industry and government leaders must work across organisational, sectoral and national borders to identify, map, and test cyber-dependency and interconnectivity risks as well as surge resilience and risk-management.

"Few business issues permeate almost every aspect of business and commerce like cybersecurity does today," said David Burg, Global Cybersecurity Leader at PwC. "Public-private coordination is critical to effectively addressing cybersecurity."

Click here to download PwC’s 2018 Global State of Information Security® Survey

Leading business support organisation Future WaterAssociation, in partnership with Waterbriefing and the support of Water UK, has launched a major survey on the growing challenges surrounding cyber security in the water sector.

Click here to access the UK Water Sector Cyber Security 2017 Survey online