A lack of resources is the top challenge to information security professionals, followed by a lack of experience and skills, a survey reveals