The latest Deloitte Global Security Survey has found the Asia Pacific region (APAC), excluding Japan, is lagging behind the rest of the world when it comes to measures employed by financial services institutions (FSIs) to prevent security breaches.
One of the most concerning statistics revealed was the low proportion of FSIs in the region that had a chief information security officer (CISO).
Only 23 per cent of APAC FSIs had appointed someone to this position, earning it a ‘worst in class’ rating for this category. In comparison, the regions of Europe, the Middle East and Africa earned ‘best in class’ for the category, with 91 per cent of their FSIs having someone employed in this capacity.
Senior management of FSIs in the APAC region were also shown to be deficient in recognising the critical nature of security threats, with only 15 per cent of respondents addressing these issues at a board level. This compared to Canada where 64 per cent of FSI boards examined these matters.
Another worrying finding of the study was that two-thirds of APAC FSIs did not have a security strategy in place. Japan set the benchmark in this category globally, with 93 per cent of its FSIs possessing such a strategy.
The results are likely to have significant implications for APAC FSIs, as the research uncovered a dramatic increase in the number of security attacks over the past 12 months.
Seventy-eight per cent of respondents admitted to experiencing an external security breach, up from 26 per cent in 2005, with internal breaches happening to 49 per cent of participants, up from 35 per cent last year.
However, Deloitte partner enterprise, risk services, Julie Priest thought the situation was more positive for Australian companies than the statistics reflected at face value.
“In working with our banking clients we’ve seen in Australia that although this is showing in the APAC region that they’re ‘worst in class’, in Australia we actually believe that some of these [issues] have already been addressed to some extent,” she said.
Priest felt a combination of factors, such as suffering a security breach and experiencing a resultant drop in consumer confidence, would act as the main drivers for FSIs to change their current security practices.
Deloitte partner enterprise, risk services, Dean Kingsley felt management attitudes on the whole also had to be modified.
“I think fundamentally there has to be a change of company mindsets from this being a technology problem to this being a business problem,” he said.
The fourth annual survey studied organisations across the banking, insurance, investment and securities, and payment and processing sectors over the four geographic regions of North America, Europe, Middle East, and Africa, Asia Pacific, and Latin America and the Caribbean.
