Struggling to find staff with cyber security skills? Can’t find affordable staff to protect your data? That’s not the case for customers of backup and DR specialist, Databarracks. It has revealed that 56% of UK firms claim to have sufficient in-house cyber security skills to deal with threats.
The claim comes as it publishes its latest Data Health Check survey (registration required).
It’s an interesting claim. The UK, like other countries, has a significant skills shortage in this area. There are far more jobs than candidates when it comes to cyber security. This has created an arms race in salaries that has priced companies out of the market as security service providers and vendors bid for those with skills.
Peter Groucutt, managing director of Databarracks commented: “Investment in cyber security safeguards, should translate to improved confidence but the findings show it is yet to make a significant difference.
“We are in the midst of a rapidly accelerating arms race. Organisations are desperately trying to match criminals, by working hard to improve knowledge, training and investment in security defences, but are clearly concerned about keeping pace. Importantly, organisations shouldn’t become disheartened. While confidence levels are not where we hoped, businesses are making positive strides and acting on the front-foot to fight back, which makes us optimistic for the future.”
Increased trust in backup, business continuity and disaster recovery?
The 47 page report throws up some interesting views on how prepared organisations are when it comes to backup and disaster recovery. Questions on backup revealed:
- 44% are backing up more than 10TB of data, twice the amount they backed up a decade ago.
- Encryption of backups has also risen but only by 14%. There are still 33% of companies not encrypting their backup.
- The majority of respondents were also more confident that they could trust their backups. This may be due to the increased attention to backup logs to quickly spot problems. However, the number of completed restore tests is still low. Less than 30% of respondents do any regular restore tests either on-premises or in the cloud.
It seems that DR, often little more than a paper exercise, is getting increased attention. This is likely due to the number of cyber-attacks such as ransomware that have forced companies to invoke their DR plans. The survey shows:
- 82% have a specific DR plan for their IT systems
- 47% have tested that plan in the last year
- 68% have tested their plan against specific cyber threats such as ransomware and DDoS
- 43% were able to meet the Recovery Time Objective set by the board of directors
Over all, most of the above responses are what would be expected. Backup and restore is a mature activity and is core to any BC or DR plan. The only question here is where are the restores and DR tests taking place. Both can be highly disruptive to a business and few companies today have the hardware to replicate their IT infrastructure. However, just running in the cloud is not a given. It requires a lot of attention to dependencies and effective testing.
What about cyber security skills and threats?
This is much more interesting and throws up some interesting responses from the number of cyber threats to the impact of IoT on cyber security.
- 23% have had a cyber threat in the last year
- 11% have seen multiple threats
- 38% have reviewed and updated their security policies in the last year
- There has been an across the board investment in training, polices and solutions to protect against cyber threats
- 56% believe they now have sufficient cyber security skills in-house to deal with current threats
- Concerns over IoT are broadly no different from last year despite 13% putting in new policies to deal with IoT threats
- Cyber security budgets have increased with 35% saying they have more to spend than last year
Taken at face value this looks positive. But there are some concerns when you look at the wider data. The number of companies seeing cyber threats is still low. Those who have seen one or more threats is still just 34%. This might be due to increased cloud computing where cloud providers are stopping attacks at the boundary.
It is also possible that the increased attention on policies and staff training is having an impact on attacks. If so, that is really good news among this group of organisations.
What does this mean
This is an interesting survey as much for what it doesn’t tell us as what it does. We don’t know how companies are doing their DR testing. Are they replicating their environments in the cloud or doing spot tests on-premises? How are they measuring success of those plans?
In India, banks have to not only implement their DR plans but run the business off of those systems several times a year. Just restoring data and doing a series of random checks is not the same. Few companies like to implement their DR plan due to the disruption to the business. For a DR plan to be effective, there has to be proof of more than the restore worked. Perhaps next year, Databarracks will dig a little deeper into what testing of the DR solution its customers do.
Perhaps the biggest surprise here is that 56% of respondents believe that they have enough cyber security skills in-house. This puts Databarracks customers in an elite group of companies who have been able to attract, employee and retain highly sought after staff.
