Connect with us

BizNews

Security response planning on the rise, but containing attacks remains an issue – IBM

While organizations surveyed have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13% during this same period.

Published

on

IBM announced the results of a global report examining businesses’ effectiveness in preparing for and responding to cyberattacks. While organizations surveyed have slowly improved in their ability to plan for, detect and respond to cyberattacks over the past five years, their ability to contain an attack has declined by 13% during this same period.

The global survey conducted by Ponemon Institute and sponsored by IBM Security found that respondents’ security response efforts were hindered by the use of too many security tools, as well as a lack of specific playbooks for common attack types.

While security response planning is slowly improving, the vast majority of organizations surveyed (74%) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all. This lack of planning can impact the cost of security incidents, as companies that have incident response teams and extensively test their incident response plans spend an average of $1.2 million less on data breaches than those who have both of these cost-saving factors in place.

The key findings of those surveyed from the fifth annual Cyber Resilient Organization Report include:

  • Slowly Improving: More surveyed organizations have adopted formal, enterprise-wide security response plans over the past 5 years of the study; growing from 18% of respondents in 2015, to 26% in this year’s report (a 44% improvement).
  • Playbooks Needed: Even amongst those with a formal security response plan, only one third (representing 17% of total respondents) had also developed specific playbooks for common attack types — and plans for emerging attack methods like ransomware lagged even further behind.
  • Complexity Hinders Response: The amount of security tools that an organization was using had a negative impact across multiple categories of the threat lifecycle amongst those surveyed. Organizations using 50+ security tools ranked themselves 8% lower in their ability to detect, and 7% lower in their ability to respond to an attack, than those respondents with less tools.
  • Better Planning, Less Disruption: Companies with formal security response plans applied across the business were less likely to experience significant disruption as the result of a cyberattack. Over the past two years, only 39% of these companies experienced a disruptive security incident, compared to 62% of those with less formal or consistent plans.

“While more organizations are taking incident response planning seriously, preparing for cyberattacks isn’t a one and done activity,” said Wendi Whitmore, Vice President of IBM X-Force Threat Intelligence. “Organizations must also focus on testing, practicing and reassessing their response plans regularly. Leveraging interoperable technologies and automation can also help overcome complexity challenges and speed the time it takes to contain an incident.”

Updating Playbooks for Emerging Threats
The survey found that even amongst organizations with a formal cybersecurity incident response plan (CSIRP), only 33% had playbooks in place for specific types of attacks. Since different breeds of attack require unique response techniques, having pre-defined playbooks provides organizations with consistent and repeatable action plans for the most common attacks they are likely to face.   

Amongst the minority of responding organizations who do have attack-specific playbooks, the most common playbooks are for DDoS attacks (64%) and malware (57%). While these methods have historically been top issues for the enterprise, additional attack methods such as ransomware are on the rise. While ransomware attacks have spiked nearly 70% in recent years, only 45% of those in the survey using playbooks had designated plans for ransomware attacks.

Additionally, more than half (52%) of those with security response plans said they have never reviewed or have no set time period for reviewing or testing those plans. With business operations changing rapidly due to an increasingly remote workforce, and new attack techniques constantly being introduced, this data suggests that surveyed businesses may be relying on outdated response plans which don’t reflect the current threat and business landscape.

More Tools Led to Worse Response Capabilities
The report also found that complexity is negatively impacting incident response capabilities. Those surveyed estimated their organization was using more than 45 different security tools on average, and that each incident they responded to required coordination across around 19 tools on average. However, the study also found that an over-abundance of tools may actually hinder organizations ability to handle attacks. In the survey, those using more than 50 tools ranked themselves 8% lower in their ability to detect an attack (5.83/10 vs. 6.66/10), and around 7% lower when it comes to responding to an attack (5.95/10 vs. 6.72/10).

These findings suggest that adopting more tools didn’t necessarily improve security response efforts — in fact, it may have done the opposite. The use of open, interoperable platforms as well as automation technologies can help reduce the complexity of responding across disconnected tools. Amongst high-performing organizations in the report, 63% said the use of interoperable tools helped them improve their response to cyberattacks.

While security response planning is slowly improving, the vast majority of organizations surveyed (74%) are still reporting that their plans are either ad-hoc, applied inconsistently, or that they have no plans at all.

Better Planning Pays Off
This year’s report suggests that surveyed organizations who invested in formal planning were more successful in responding to incidents. Amongst respondents with a CSIRP applied consistently across the business, only 39% experienced an incident that resulted in a significant disruption to the organization within the past two years  compared to 62% of those who didn’t have a formal plan in place.

Looking at specific reasons that these organizations cited for their ability to respond to attacks, security workforce skills were found to be a top factor. 61% of those surveyed attributed hiring skilled employees as a top reason for becoming more resilient; amongst those who said their resiliency did not improve, 41% cited the lack of skilled employees as the top reason.

Technology was another differentiator that helped organizations in the report become more cyber resilient, especially when it comes to tools that helped them resolve complexity. Looking at organizations with higher levels of cyber resilience, the top two factors cited for improving their level of cyber resilience were visibility into applications and data (57% selecting) and automation tools (55% selecting). Overall, the data suggests that surveyed organizations that were more mature in their response preparedness relied more heavily on technology innovations to become more resilient.

BizNews

Structure of online reviews shapes their helpfulness

Reviews that grow increasingly positive are most helpful to readers, while those that turn negative are least helpful. For average-rated products, progressively negative trajectories enhance helpfulness, whereas reviews that start negative and grow positive are least effective.

Published

on

A study of nearly 200,000 Amazon reviews shows that the usefulness of online product reviews depends not only on what is said, but on how the information is structured.

The researchers, from the Universities of Cambridge and Queensland, studied Amazon reviews for products ranging from clothing to food to electronics. They found that how the information is organised matters as much as what is said, and that different review structures are more or less helpful, depending on how highly the reviewer has rated the product.

Their results, published in the journal Scientific Reports, could help companies and third-party review platforms design their review pages to prompt the sort of reviews that will be most helpful to potential customers.

For example, a reviewer assessing a laptop might praise its performance and design while criticising its battery life, so how should such information be structured to be most useful to the reader? Should the review begin with criticism and end on a positive note, or start positively before turning to drawbacks?

“Any target of evaluation typically has both positive and negative aspects, which makes crafting evaluative messages challenging,” said co-author Dr Yeun Joon Kim from Cambridge Judge Business School. “The key question is how to structure these elements within a single message. For example, one might present criticism upfront and then move to praise, or instead integrate negative points within an otherwise positive evaluation. Yet research has paid little attention to this structural dimension.

“We wanted to understand whether certain structures are consistently more effective, or whether their effectiveness depends on the performance of the target being evaluated.”

The study was based on 195,675 reviews of 5,487 distinct products, and assessed performance and related factors, and a helpfulness score as measured by reader votes.

The researchers identified nine possible structures of online reviews ranging from Type A reviews that start positive and become more positive as they go along, to Type I reviews that start negatively and become even more negative – with lots of variance in between.

For highly-rated products, reviews that grow increasingly positive are most helpful to readers, while those that turn negative are least helpful. For average-rated products, progressively negative trajectories enhance helpfulness, whereas reviews that start negative and grow positive are least effective. For low-rated products, reviews are judged most helpful when they open constructively before introducing criticism.

“The results are nuanced but very clear,” said co-author Dr Luna Luan from the University of Queensland, who carried out the research while earning her PhD at Cambridge Judge Business School. “Looking at the overall sentiment of reviews does not fully translate into message effectiveness. It is the broader structure of sentiment – how positivity and negativity evolve throughout the review – that shapes how readers interpret online reviews.”

“Our findings have practical implications for how platforms and companies can design review pages in order to elicit the sort of reviews that will be most helpful to readers based on how highly products are rated,” said Kim. “For example, instead of simply asking ‘Write your review here’, the online review form could instead include micro-prompts that guide how reviewers structure feedback in a way recipients find most helpful.”

The researchers found the most commonly used review styles are not necessarily the most helpful to readers. In particular, for average- and low-rated products, the structures that reviewers tend to adopt often differ from those that readers find most useful.

This mismatch likely reflects different underlying motivations. Reviewers are not always writing to maximise usefulness for others, but may instead be expressing their own experiences, frustrations or emotions – especially when evaluating products of moderate or poor quality. As a result, review writing often serves both as information sharing and as a form of self-expression. This helps explain why widely used review styles do not always align with what readers perceive as most informative or helpful.

Continue Reading

BizNews

Reversible words can lower consumer disbelief in ads

A simple word choice in marketing messages can significantly impact how confident consumers feel about believing – or not believing – a claim.

Published

on

It’s estimated that consumers experience hundreds if not thousands of marketing messages daily. While the exact number can depend, how much someone believes the message can be more important for marketing success than the number of messages they see. 

A new study reveals that a simple word choice in marketing messages can significantly impact how confident consumers feel about believing – or not believing – a claim. Researchers found that when words differ in their “reversability,” or how easily people can think of their opposites, it can trigger different mental processes when consumers evaluate marketing language. 

Imagine the messaging options for a new sunscreen designed specifically for those who like a strong scented product. The first product description reads, “The scent is prominent,” while the second notes, “The scent is intense.” The word “prominent” is uni-polar, meaning people tend to negate it by adding “not” to the original statement.

“Intense,” though, is a bi-polar word, meaning readers can easily come up with its opposite meaning and negate the statement by replacing it with its antonym. In this example, “The scent is mild,” instead of, “The scent is intense.” 

“When people encounter easily reversible words, like ‘intense’, in messages processed as negations (mild), they experience lower confidence in their judgements compared to words that are hard to reverse, like ‘prominent,’” explained Giulia Maimone, a postdoctoral scholar in marketing at the University of Florida Warrington College of Business. 

Across two experiments of more than 1,000 participants, the research demonstrated that this effect occurs because negations of bi-polar, or reversible, words engage a more elaborate cognitive process requiring additional mental effort, resulting in lower confidence of the statement’s truthfulness. 

Based on their findings, the researchers suggest that marketers take this advice when crafting language: for new products, use affirmative statements with easily reversible words, like ‘The scent is intense’ in the sunscreen example, which most consumers will judge as true with high confidence. Importantly, this language would also minimize the confidence of consumers who will be skeptical about the message, as they will process it via a more complex cognitive process that reduces confidence in those consumers’ disbelief. 

“This simple lexical choice could help companies maximize confidence in their desired messaging and minimize confidence among the doubters,” Maimone explained. 

Continue Reading

BizNews

If you’re a perfectionist at work, your boss’ expectations may matter more than your own, research finds

Help your employees by clarifying expectations through regular feedback and performance conversations to reduce role ambiguity, as doing so can provide employees with a better understanding of role expectations and enhance mutual understanding of those standards.

Published

on

If you’re among the 93% of people who struggle with perfectionism at work, new research suggests that your experience may depend less on your own high standards and more on whether those standards meet your supervisor’s expectations. 

Researchers from the University of Florida Warrington College of Business found that whether perfectionism helps or harms employees depends largely on whether employees’ personal standards align with their supervisors’ expectations. 

Specifically, they looked at the connection between employees’ self-oriented perfectionism, or the expectations of flawlessness they set for themselves, and supervisors’ other-oriented perfectionism, which reflects the extent to which they set excessively high standards for and critically evaluate their employees’ performance. 

Using data from more than 350 employees and about 100 supervisors, the researchers found that perfectionism’s impact depends on whether employees’ standards align with what their supervisors expect and how clearly those expectations are understood. 

When employees’ personal standards are aligned with their supervisors’ expectations, they tend to experience less role ambiguity, meaning they have less uncertainty about the expectations and standards for their role, why those standards matter and the consequences of not meeting them. This clarity in their work is linked to better performance, lower burnout and higher job satisfaction. 

“Problems between employees and their supervisors are more likely to arise when these expectations don’t match,” explained Brian Swider, Beth Ayers McCague Family Professor.

The most difficult situation occurs, Swider and his colleagues found, is when supervisors expect higher levels of perfectionism than employees expect from themselves. In these cases, employees reported greater uncertainty about their roles, along with worse work outcomes including higher burnout and lower job satisfaction.

“If you’re an employee who struggles with perfectionism at work, our findings suggest that understanding your supervisor’s expectations may be just as important as managing your own tendencies towards perfectionism,” Swider said. “Talking to your supervisor about priorities, standards and how your performance will be evaluated can help reduce uncertainty and ensure you both share a clear understanding of what success looks like.”

The researchers have similar recommendations for employers: help your employees by clarifying expectations through regular feedback and performance conversations to reduce role ambiguity, as doing so can provide employees with a better understanding of role expectations and enhance mutual understanding of those standards.

The researchers also recommend that organizations should consider how employees and supervisors are paired, as mismatched expectations can increase stress, reduce job satisfaction and ultimately impact performance. 

The research, “The influence of employee-supervisor perfectionism (in)congruence on employees: a configurational approach,” is published in Organizational Behavior and Human Decision Processes

Continue Reading
Advertisement
Advertisement

Like us on Facebook

Trending