The State of Cybersecurity in Florida Fact Book

2017 Fact Book

The State of

Cybersecurity in Florida

SURVEY DEMOGRAPHICS

Analysis independently prepared

by Gartner Consulting

Response by Geographic Footprint GLOBAL 45%

Response by Sector

NATIONAL 23% REGIONAL 16% LOCAL 16%

Data gathered from

12%

Financial Services and Insurance

11%

Healthcare Services

23%

Information Technology

2%

37%

Retail Trade

4%

Manufacturing

Government Education/ Educational Services

3%

Telecommunications

3% 1%

Real Estate

4%

Other

• A survey distributed to 2,253 Florida businesses, nonprofit and academic organizations, and government entities • Interviews with leaders in government, academia, and industry • Data collected by the Florida Agency for State Technology • National benchmarking data, current research, and industry reports

TOP TAKEAWAYS • Cybercrime will continue to increase due to Florida’s robust economic landscape • A long-term lack of investment in cybersecurity and an emphasis on compliance over security have placed Florida slightly behind other states in the overall cybersecurity posture of its businesses and organizations • Florida is well positioned to develop a strong workforce, with approximately 100 cybersecurity certificate and degree programs offered by institutions of higher education across the state

WORKFORCE DEVELOPMENT State of Cybersecurity in Florida Survey Staffing Challenges

40% 30% 20% 10% Technical Security Skills/Staff

68%

of organizations report cyber staffing challenges

12,641: total number

of cybersecurity job openings in Florida in 2017 Source: CyberSeek.org

Security Analysts

Entry-level Support Staff

Security Leadership/ Governance

Gartner FC2 2017 State of Cybersecurity in Florida Survey

$

Florida employers have increased compensation by $5,000 to $10,000 per employee to fill mid- and junior-level positions Nearly a quarter of junior cybersecurity professionals in Florida earn more than the national average for their positions.

s.

Mirroring the global trend, Florida is experiencing a cyber talent shortfall that is predicted to intensify through 2020.

Competition within the state has driven salaries for some job types well over the national average.

THREATS

• Reports of corporate data breach in Florida increased 17.8% between 2015 and 2016 • 41% of respondents have suffered a breach • 66% of those breached classify the breach as “moderate,” while 11% classify it as “high” in severity • Only 32% of surveyed organizations are confident they are prepared for a cyberattack • 51% of organizations surveyed do not have adequate funding to complete required security projects; top reasons are organizational financial constraints, lack of skilled resources, and lack of management support • $6.1 billion: estimated annual cost of data breaches in Florida

18% Phishing Attacks 9% Crypto/

Ransomware

15% Insider Attacks 10% User Awareness 11% Lack of Resources

or Funding

8% Uncontrolled

Portable Devices

(e.g., phones, tablets)

What types of information are you protecting?

12%

Intellectual Property

22%

Personally Identifiable Information (PII)

11%

Protected Health Information (PHI)

25%

Financial Information

4%

Criminal Justice Information

16%

Organizational Reputation

8%

Other Florida Information Protection Posture

6% Malware brought

into the environment from the outside (e.g. USB drives)

11% Hacking

Attempts

5% Web-based Malware

5% Email-based Malware

2% Other

Greatest Security Risks

Florida ranks third in the nation for cybercrime incidents and losses reported to the FBI, yet more than half of respondents lack funding for adequate cybersecurity.

SECURITY

While more than 85% of respondents have disaster recovery and business continuity plans, only 32% regularly test those plans.

52%

OF SECURITY BREACH ROOT CAUSES ARE HUMAN ERROR But FEWER than a third of respondents rank human error as a serious concern

56% of survey respondents have a single, consolidated change management process.

O N LY

18%

of respondents have an automated patch (update) management process.

10% apply patches manually.

The Positives 80% of organizations surveyed require all personnel to complete security training.

87% of respondents technologically enforce strong passwords.

Despite the widespread use of mobile devices, only 46% of organizations surveyed have a mobile device strategy.

Insufficient funds, the talent shortage, poor planning and communication, and a lack of policies and processes were routinely reported as the top obstacles to effective cybersecurity.

Florida Center for Cybersecurity (FC2) The Florida Center for Cybersecurity is a statewide resource established to position Florida as a national leader in cybersecurity through education and workforce development; innovative, interdisciplinary research; and community engagement. With a geographic footprint that spans Florida and encompasses all twelve State University System of Florida (SUS) institutions, the Center serves as a hub for creating connections, building partnerships, capitalizing on opportunities, and encouraging collaboration among stakeholders in industry, academia, government, and defense. The Center hosts events to engage a diverse audience base throughout the year and administers funding programs that support collaborative research and cybersecurity programming at SUS institutions.

Gartner Consulting Powered by the world’s most comprehensive collection of technology research and data, Gartner Consulting helps CIOs and IT leaders address mission-critical priorities to achieve stronger business outcomes in a digital world. Gartner Consulting is a unit of Gartner Inc., with more than 900 consultants serving clients around the world.

To view the full report visit: theFC2.org

Gartner Consulting deliverables are created specific to client engagements and are not intended to be applied broadly. All services are provided on an “as is� basis. The information in the deliverables has been obtained from client and third-party sources that Gartner believes to be reliable. All deliverables speak as of the date of the delivery to the client. Gartner has no obligation to advise client of any change in the information or views contained in the deliverables.

Client recognizes that the services are not a substitute for its own independent evaluation and analysis and do not constitute a recommendation to pursue a specific course of action. Gartner shall not be liable for any actions that the client may take based on the services or any information or data contained therein. Any other reproduction of this deliverable in any form without prior written permission is forbidden.

Supporting all twelve institutions in the State University System of Florida

Florida A&M University

New College of Florida

Florida Atlantic University

University of Central Florida

Florida Gulf Coast University

University of Florida

Florida International University

University of North Florida

Florida Polytechnic University

University of South Florida

Florida State University

University of West Florida

Florida Center for Cybersecurity • 4202 E. Fowler Ave. • Tampa, FL 33620 • theFC2.org