Why many companies can't deal with simple cyber security problems

Most corporate information security executives believe their teams can only handle “simple” incidents, like deactivating a lost phone or scanning a computer for a virus. This reflects a steady loss of confidence among corporate infosec pros in their ability to keep up with modern threats, according to a new global survey by ISACA, a non-profit group that certifies security professionals, and the RSA Conference, a series of events by security vendor RSA.

The same survey, conducted two years ago, found that 87% of respondents were comfortable with their teams’ ability to deal with security incidents. That figure dropped to 73% in the latest survey, which polled 461 information security practitioners and managers:

The survey also revealed the types of incidents that corporate infosec executives face on a daily basis. Almost a third reported dealing with phishing attacks–attempts to trick users into divulging sensitive information with cleverly disguised messages–every day. Malicious code and hacking are the other two problems that security pros grapple with daily.

Things aren’t looking up for the people charged with keeping corporate systems safe. There’s a skills gap in the infosec space, with most survey respondents saying it takes between three and six months to fill a vacancy. And even when a hire is made, respondents most frequently said that less than a quarter of those are actually qualified for the job. Companies generally provide on-the-job training to hires to get them up to speed, according to the survey.

Understaffed, underqualified, and overwhelmed security departments aren’t feeling optimistic about their ability to keep up with new technologies, and the threats these bring. A majority of respondents saw artificial intelligence posing a risk to corporate security. They were also concerned about the growth of the Internet of Things, which expands the “attack surface” available to hackers.

But Ron Hale, ISACA’s chief knowledge officer, says security managers shouldn’t be so glum. “When there’s a risk there’s a reward,” he told Quartz. “We can use AI to identify where hackers are; we can identify what incidents are occurring in a system. We can start using these systems to our benefit, rather than just relying on human judgment.”