Business Digital Security

Have you heard that?

• Ryanair has been stolen nearly $5m
• Dropbox left 6.9 million accounts possibly compromised
• TV5 Monde has been hacked and taken down
• Target corporation was stolen around 40 million credit and debit cards data
• …

Probably. Because cyber attacks are unfortunately becoming popular in terms of frequency, business impacts and visibility. When reading the headlines, citizens, end consumers, senior executives and shareholders are more and more aware of serious data breaches.

Cybersecurity is hopefully considered as a growing business concern for most corporations.

(Lack of) Cybersecurity may even jeopardize member of the board of directors. Thus, in the US, in the five recent years, shareholders have initiated litigation against the directors of the Target, Wyndham Worldwide, TJX Companies, and Heartland Payment Systems. We can probably assume that this phenomenon will amplify and entry European markets.

Another risk that board of directors face is “activist” shareholders. They can make alliance to challenge re-elections of directors when it’s perceived that they didn’t do enough to prevent a cyber attack. Indeed, on behalf of shareholders, role of the board of directors is all about governance, i.e. to control and oversight business strategy related decisions and to manage efficiently risks.

For example, the data breach has cost the Target corporation a significant drop in its profit, which was estimated around 40% in the 4th quarter of the year. As a consequence, the Target CEO was also dismissed. Then after, shareholders of Target urged to oust seven of Target’s ten directors for “not doing enough to ensure Target’s systems were fortified against security threats” and for “failure to provide sufficient risk oversight” over cybersecurity.

In which area did board of directors “fail”?

According to the New York Stock Exchange’s definitive cybersecurity guide (October 2015), board of directors mainly fails:

• To implement and monitor an effective cybersecurity program;
• To identity and protect company assets and business by recklessly disregarding cyber attack risks and ignoring red flags;
• To implement and maintain internal controls to protect customers’ or employees’ personal or financial information;
• To take reasonable steps to notify individuals in a timely fashion that the corporation’s information security system had been breached.

What do the board of directors need to ask?

Cybersecurity is becoming a strategic issue and needs to be addressed with a strong and professional risk management approach, like any other business risks (strategic, financial, operational, etc.).

Even if cybersecurity is now to be considered as a business risk by the board, it’s strongly recommended that board of directors ask the following questions:

1. What are the most valuable business assets to protect? Are both external and internal threats considered when planning cybersecurity program activities? Does the organization understand the origin of the threats (e.g. cybercriminals, competitors, governments, rogue employees, etc.)?
2. Does the organization have a sound and consistent cybersecurity strategy and program? Does the organization use an ISMS framework such as ISO 27001?
3. How is cybersecurity governance managed within the organization? Is it well integrated into the corporate governance? Are the roles and responsibilities well defined among directors, business, IT and cybersecurity stakeholders?
4. What are the top five-cybersecurity risks the organization faces? How does the organization manage uncertainty? Are cyber risks related to strategic partners considered? Is it addressing new business cases like mobile devices, the bring-your-own-device trend, big data, or cloud computing?
5. How are employees made aware of their role related to cybersecurity? Does every employee receive some basic cybersecurity awareness training?
6. In the event of a serious breach, has management developed a robust response protocol? What incident response and crisis management approaches are in place?

Thus, every CISO should shape and implement a long-term, clear and shared cybersecurity strategy and governance framework, both aligned with the corporation business strategy and governance. ISMS will help to support gathering various stakeholders’ expectations.

The increase in data breaches will force the CISO to climb the agenda in board meetings.

As a result, board members, business executives, IT and cybersecurity will better understand their respective roles and accountabilities regarding cybersecurity.

This strategic roadmap should be regularly updated and tailored to the business environment and provide accounting perspectives with powerful KSIs. It will bring more attention from the board and the business lines executives.

It will also enable directors of the board to stay involved in the corporation’s cybersecurity program and to involve themselves in a higher level of engagement with the risks associated.

To strengthen their involvement, board members should receive from the CISO periodic cyber risks updates and have also access to external cyber experts whose expertise and experience board members can rely on in making decisions about what to do (or not) to manage cyber risks.

Because board members will be more involved, it will promote cybersecurity, and engage senior management, middle management and finally ALL employees. The employees of the corporation will become the first line of defense in the event of cyber attacks.

As a whole, it will improve the overall resilience of the corporation business lines and its IT infrastructures, and we can expect that it will bring more value to shareholders, which will better protect board members from « activists » shareholders.

Stay tuned with: https://business-digital-security.com

We explore the three stages involved in reaching Cyber Resilience, from examining the current situation to breaking the dynamics of failure and reaching and maintaining the end goal.

1. The current cybersecurity situation in many large organisations is dominated by significant blockers.

Cybersecurity is still broadly perceived as an IT discipline, built around technical solutions and projects – you only have to open any industry magazine or publication to see it, or go to any professional show.

The “three lines of defence” models promoted in some form or another by various standards, such as COSO or ISO 31000, are poorly understood and poorly applied. Cybersecurity is often arbitrarily kept in a technical first line, in spite of its complex nature, requiring a true implementation across the three lines of defence – and across many corporate silos.

In practice, this excessive technical focus – which spans the entire industry history – is failing for most large organisations. In fact, many of these organisations claim to spend in excess of 3% of their total IT spend on cybersecurity, but in spite of the amounts invested over the years – 79% have not yet achieved an acceptable level of cybersecurity maturity (‘Risk and Responsibility in a Hyper-connected World’ – World Economic Forum, January 2014). These results are echoed by the RSA Cyber Poverty Index published in June 2015.

This failing situation is rooted in the lack of cultural fit between cybersecurity and IT mindsets. Technologists are essentially trained and incentivised to deliver functionality and features – not risks and controls – and this leads to a tactical and technical security focus that rarely delivers true results in large organisations.

Those large organisations have become increasingly dependent on a larger and larger number of third parties, with cybersecurity problems often global and complex in nature, and the threats they face continue to evolve at a faster and faster pace. The geographical, operational and technical complexity of large organisations requires a well-designed strategy and proper governance framework, that is rarely in place, to enable the true delivery of cybersecurity solutions on a global scale.

This lack of results can drive middle-management frustration and budgetary tensions around cybersecurity internally, which in turn brews demotivation and further talent alienation away from cybersecurity functions. It is often also the lack of results (or insufficient or slow progress), which attracts the attention of auditors and regulators on these matters; those are often ‘low hanging fruits’ in absence of any strategic vision around cybersecurity.

This, in turn, is effective at drawing the attention of Executive Management towards the topic – but for all the wrong reasons. And when coupled with the increasing media and political attention around cybersecurity, it simply aggravates the tactical dynamics around cybersecurity. Driven by endemic fears of negligence claims and short-termism compliance obsessions, money – which wasn’t there yesterday – suddenly appears out of nowhere just to fix audit or compliance issues. Senior Executives can go to the media or claim with their peers that “cyber is on our agenda and money is there”, but in practice, the lines haven’t really moved at all – and the same old mistakes and habits are being perpetuated.

Over time, cybersecurity becomes an overhead and a problem – instead of a necessary barrier against real and active threats to the business. And, in practice, money is often simply wasted to put ticks in boxes. A large number of technology companies make a good living in that compliance space, but this eco-system is inherently unhealthy. This results in stagnating protection levels and low cybersecurity maturity, which is what the World Economic Forum report highlighted last year.

2. Large organisations, which find themselves in such a situation – and want to break these dynamics of failure – must rethink their approach and rewire their cybersecurity practice by acting at three levels.

• The profile of the CISO needs to be right in order to drive change.

Look without complacency at the cybersecurity history across the firm, and at the barriers that have prevented progress. The CISO needs to have the right amount of business and management experience, personal gravitas and political acumen to be credible with all stakeholders across corporate silos (not just technologists) – these are attributes of seniority. Cybersecurity is not just a technical discipline.

Cybersecurity is all about protecting information, which is at the heart of the organisation value chain and business processes. Therefore, only with the right attitude and experience will the CISO be able to reach out of IT to all stakeholders and drive success. Of course, the reporting line of the CISO is of paramount importance in that context. It should be to the CIO or the COO in most cases and delegating down must be avoided at all costs – as it would simply confuse objectives and create opportunities for political tensions with stakeholders. This would destroy any credibility around the real desire of Executive Management to drive change.

Raising the profile of the CISO (and their reporting line where necessary) will break the dynamics of talent alienation around cybersecurity. Sound governance, coupled with a better management and political acumen at senior level within cybersecurity, will break the dynamics of failure around delivery. Pinning success against a long-term backdrop and ensuring that the CISO and key personnel remain in place throughout will help Executive Management develop a true sense of purpose around cybersecurity, beyond short-termism or audit and compliance obsessions.

• The CISO needs to structure their relationship with all stakeholders as part of a strong Cybersecurity Governance Framework, positioning roles, responsibilities and accountabilities across the cybersecurity space and across the whole organisation from the top down.

The CISO must also define a proper Target Operating Model for the cybersecurity team itself – which would give it a strong backbone, a clear structure and an unambiguous sense of purpose internally.

All of this is key to driving success. For example, you cannot imagine delivering a successful Identity & Access Management programme of work without the involvement of HR – and the business units if they are allowed to hire & fire directly. There needs to be clear demarcation lines around what gets done within the cybersecurity team and what remains outside of it.

The whole governance model should also address, without complacency, the full geographical spectrum of the business – and its true nature in terms of dependencies on third parties.

• The cybersecurity department should be seen as a true Business Unit, and therefore, every CISO should establish a long-term, clear and shared strategic roadmap – and be prepared to stay in charge for the time it will take to deliver it.

Real and long-lasting change in the cybersecurity space will involve a cultural shift for most large organisations – and the embedding of a structured practice and a controls mindset in the way the organisation works. It will not happen quickly. It could typically involve an initial transformation cycle of several years, followed by a consolidation cycle of several years.

The CISO and key team members may have to consider their tenure over a 5 to 7 year horizon to genuinely drive change through. During the period, all actions (technical or not) must be pinned against a consistent long-term backdrop – including any unavoidable short-term tactical initiatives (typically driven by incidents, audit observations or compliance requirements). Inconsistencies and a constant reshuffling of priorities would simply kill the change momentum, as would the untimely removal of key personnel.

3. The resulting outcome should be a cyber resilient organisation, where cybersecurity is embedded in the business environment.

A long-term strategic roadmap for cybersecurity that is regularly updated, tailored to the business’s environment and provides financial perspectives – will bring multiple benefits:

• Traceability up to the organisation strategy and business lines’ requirements
• Improved overall resilience of business lines and cyber infrastructures
• Improved visibility and control over costs (where that’s a concern)

This should bring more attention from the Board and the business lines, and improve their engagement with the cybersecurity concepts – leading to more constructive discussions around cybersecurity budgets and costs.

Over time, focus on information risk should drive meaningful intelligent actions, and cybersecurity should become a valuable business function at the heart of the organisation – not just an IT department that deals with audit and compliance issues.

This article is based on an earlier article by Corix Partners, which Corix Partners () and Business Digital Security () have revisited jointly to reformulate its content as the foundations of a road to cyber resilience.