CISOs weathered the pandemic well, but at personal cost

Despite a surge in cyber attacks and other security incidents, the chief information security officer (CISO) community appears to be generally satisfied with their performance during the course of the Covid-19 pandemic. Indeed, 88% say their existing security capabilities weathered the storm with little negative impact seen on their organisational capabilities.

This is according to a study of members of ClubCISO, a 500-strong private members forum of security leaders, which has just released its eighth annual Information security maturity report. The report seems to show that years of innovation and hard work from security professionals has paid off in the past 12 months. In fact, the pandemic had less of an impact on its members than might, at first, have been anticipated.

Stephen Khan, chair of ClubCISO, commented: “This year, our ClubCISO Information security maturity report highlights some significant improvements to global business security functions and improvements to organisations’ security culture.

“Though the pandemic has increased the risk of security breaches, with more sophisticated and numerous attacks taking place, security teams have adapted well and have used the unprecedented situation brought about by the pandemic to highlight the importance of security and increase their organisations’ understanding of it.”

However, the report also showed that this resilience came at a steep cost in human terms, with new ways of working and fragmented, understaffed teams piling unprecedented levels of pressure on security professionals, making stress and burn-out an even more pressing issue for the community than it was before Covid.

Over 60% of the CISOs surveyed for the study said they had experienced an increase in stress over the past 12 months, and detailed similar feelings among their direct reports. Even now, as restrictions ease in many countries thanks to the success of vaccination programmes, 6% report their team is experiencing “unbearable” stress, and 36% believe the stress their teams are under is having a damaging effect on their ability to perform as the organisation needs.

Skills and resourcing shortages were also amplified during the pandemic, and understandably are also a big contributor to stress and poor mental health among security staff. Just under half (45%) of respondents said skills and resourcing problems greatly contributed to their stress levels, and just over half (53%) said staff shortages were a key issue stopping them from delivering against this.

ClubCISO said it was clear that stress remained a problem for the security community, and that it was imperative that employers work with their CISOs and security teams to try to address this.

Manoj Bhatt, ClubCISO advisory board member and head of cyber security advisory at Telstra Purple, said: “Given today’s unrelenting threat landscape, CISOs have arguably the toughest jobs on the organisational chart.

“CISOs have arguably the toughest jobs on the organisational chart. They must be available to many different departments and remain ahead of the curve in an ever-changing threat landscape, across all areas of cyber security”