eBook
Available on Compatible NOOK devices, the free NOOK App and in My Digital Library.
Related collections and offers
Overview
Product Details
| ISBN-13: | 9781787198906 |
|---|---|
| Publisher: | Legend Times Group |
| Publication date: | 02/28/2018 |
| Sold by: | Barnes & Noble |
| Format: | eBook |
| Pages: | 250 |
| File size: | 7 MB |
About the Author
Read an Excerpt
CHAPTER 1
1.1 BUILDING BUSINESS RESILIENCE
Nick Wilding, AXELOS RESILIA
INTRODUCTION
This chapter contends that a missing key in the creation and growth of a truly cyberresilient organisational culture lies in building a vigilant and resilient workforce through effective awareness learning for all.
KEYWORDS are: cyber security, cyber resilience, resilient workforce, storytelling, boardroom engagement.
THE NATURE OF THE CHALLENGE
Baroness Dido Harding, the outgoing CEO of TalkTalk, called cybercrime 'the crime of our generation' when she was thrust into the media gaze following their high-profile breach in October 2015. Her experience is by no means unique — the threat we all face is real and relentless.
Symantec, in their 'Internet Security Threat Report' published in April 2016, noted that they had:
'... discovered more than 430 million unique new pieces of malware in 2015, up 36 percent from the year before. Perhaps what is most remarkable is that these numbers no longer surprise us. As real life and online become indistinguishable from each other, cybercrime has become a part of our daily lives. Attacks against businesses and nations hit the headlines with such regularity that we've become numb to the sheer volume and acceleration of cyber threats.'1
This 'numbness' is echoed in research carried out by the National Institute of Standards and Technology (NIST) in the US. They assessed perceptions and beliefs about cybersecurity and online privacy, and identified that people are increasingly desensitised to constant reminders about cyber risks. One of the research respondents, an 'average technology user', commented: 'I don't pay any attention to those things any more ... people get weary of being bombarded by "watch out for this or watch out for that".'
SECURITY FATIGUE
The last quote highlights the difficulties we face in moving beyond the frustration, weariness and 'security fatigue' many of us feel from the bombardment of messages about the dangers lurking online.
The NIST research found that many of us often feel out of control or resigned to doing nothing about online security. Now, take these attitudes into the workplace and organisations are faced with a real dilemma. The reality is that cyber attackers often find it easier to communicate with, engage and influence the behaviours of our staff than we do. Technology is not the only answer — just a part of it. In 2015, Tom Farley, President of the New York Stock Exchange, said in his introduction to 'Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers':
'It is important companies remain vigilant, taking steps to proactively and intelligently address cybersecurity risks within their organisations. Beyond the technological solutions developed to defend and combat breaches, we can accomplish even more through better training, awareness and insight into human behaviour. Confidence, after all, is not a measure of technological systems, but of the people who are entrusted to manage them.'
THE HUMAN FACTOR
But there's a huge challenge here — one which was starkly highlighted in Verizon's 2015 Data Breach Investigations Report: the great majority — estimated to be 90 per cent — of successful cyberattacks succeed because of human error. That means anyone in any organisation, irrespective of their role or seniority, can enable an attack to succeed through their unwitting actions. Jim Baines, the apocryphal CEO whom I cite in Chapter 5.1, couldn't agree more:
'Unwitting is the point. Some of my friends say "witless" but that's another matter. The point is, we were complacent. We thought it was a technical not a human issue. But it's all about the human.'
Because most organisations don't think this way, the cyber attackers will always have the upper hand. They only need to be successful once in their relentless targeting of our human vulnerabilities, whereas we must maintain constant vigilance. In Jim's case, he was sent an email purporting to be from someone he'd met at a corporate golf event. The email offered pictures of his achievements on the fairway. He opened it on his business laptop and thought nothing of it. The names used were all familiar; one was from his distant past. It all seemed to make sense. But the attachment contained malware that infected the systems of Baines Packaging. Jim happened to be putting together a presentation for one of his major clients, a huge food conglomerate, and he put the presentation on a flash drive, went to a meeting and handed it to his contact — an old friend — who then infected that company's systems. A chain reaction began. Jim's entire livelihood was compromised.
That chain of events powerfully illustrates why we all — from the boardroom to the engine room and beyond — have a specific role to play in protecting our most precious information and assets. If an organisation's people represent its greatest vulnerability, then it follows they can also be its most important and cost-effective defence against attacks. I would suggest that we're at a crossroads in our collective corporate response to the cyber risks we all face: one where many will continue to invest in more technology and expect that multiple layers of technical defence will suffice. Another group – the market leaders, pioneers and innovators, but increasingly the 'just plain sensible' – will change direction and embrace an enterprise-wide approach, led from the top, which uses new methods to engage and openly reward good cyber behaviours, from top to bottom.
On the road taken by this group, storytelling and the business language used will play a vital role in an adaptive and open approach to learning. It's these firms that also understand that cyber resilience will become a key market differentiator for asserting competitive advantage as customers, partners and — let us not forget — regulators (particularly with the General Data Protection Regulation [GDPR] coming into effect in March 2018) increasingly demand demonstrable proof that their most precious information is being kept safe and secure.
Many firms also increasingly understand that their cyber risks need to be managed in balance with the immense opportunities for operational transformation, innovation and efficiency that digital technologies now offer. As Daniel Dobrygowski, the Global Leadership Fellow for the IT industry at the World Economic Forum, said in January 2017:
'Cyber risk is a systemic challenge and cyber resilience is a public good. Without security and resilience in our networks, it will be impossible to safely take advantage of the innumerable opportunities that the Fourth Industrial Revolution is poised to offer. Responsible and innovative leaders, therefore, are seeking ways to deal with these risks.'
Storytelling plays an important role in responding to this systemic challenge; stories spark emotions, and they help people to remember information.
YOUR STRONGEST DEFENCE
Mostly, cybersecurity is communicated within organisations as a set of statistics and data about the latest threats, the changing techniques adopted by cyber attackers and the number of events and incidents experienced. As a method of bringing about systemic and cultural change, this is a flawed approach.
I believe that the opportunity is clear: staff are not, as is so often lazily reported, 'our weakest link'. They are instead our most powerful and effective defence against attacks and only as 'weak' as the strength of the awareness training we give them. But does this training engage? Is it relevant and relatable to the learner? Does it provide simple, practical guidance? Is it focused on giving them the confidence to change their existing behaviours and to discuss incidents with their colleagues? Does it tell a strong story about what 'good' looks like?
The sad truth is that most organisations continue to educate their people with an annual information security awareness e-learning exercise. It can take over an hour to complete and typically ignores some basic rules for effective learning. With cyber attacks relentlessly targeting and threatening our most sensitive and valuable information, forgetting, sadly, is no longer an option. Ignorance isn't a defence anymore. The risks and potential impacts are too great.
In this vital area of staff training and development, one size doesn't fit all. The current 'all staff, once a year' approach simply does not influence or sustain long-term behavioural change. At best, it reminds us of some essentials; at worst, it's treated as a necessary evil, a distraction, and something to be completed as quickly as possible.
Annual e-learning will not instil and sustain the cyber-resilient behaviours that employees need today. We're trying to 'programme' our people in the same way we programme computers: to do certain things, in defined ways, at certain times. This approach doesn't work with human beings.
During January 2016, AXELOS RESILIA, with IPSOS Mori, carried out research among those responsible for information security awareness learning in their organisations. We wanted to find out how well prepared members of the UK's workforce were for a cyber attack in the companies they work for. The results were sobering.
While it was positive to note that 99 per cent of business executives responsible for cyber awareness learning said that information security awareness learning was 'important to minimise the risk of security breaches', less than a third (28 per cent) judged their organisation's cybersecurity awareness learning as 'very effective' at changing staff behaviour.
A similar minority (32 per cent) were 'very confident' that the learning was relevant to their staff, while 62 per cent were only 'fairly confident'. This comparatively low level of corporate confidence in the ability of people to deal with a cyber attack is simply not good enough in an era where cybercrime has become 'business as usual'. It reflects either a lack of understanding or a state of denial about the impact that a successful cyber attack can have on a business.
Organisations cannot continue to accept this low level of employee awareness and competence in the face of sophisticated cybercriminals who are constantly adapting their methods. Imagine how your customers would respond if told, 'We're fairly confident that your confidential information is safe from attack'. Equally, a report to a board of directors that the level of confidence in the organisation's information security awareness is only 'fair' would provoke some serious alarm. If company boards are not asking questions about the current effectiveness of their awareness learning programme and what is being done to improve their organisational cyber resilience, then they should be. Now!
AWARENESS TRAINING
What determines the capability and performance of employees is the relevance and effectiveness of the training they're provided with and the behaviours they adopt as a result.
What needs to be understood is that we all learn differently and at different speeds. We need to offer awareness training that provides our people with multiple approaches that appeal to the widest possible spectrum. This way, they are far more likely to have the confidence to share and discuss experiences, to get proactively involved in their own learning, to champion resilience to others and to continuously learn and adapt. That's why the picture painted by our research suggests that the current annual compliance-based approach, which is still relied upon by most organisations, is failing.
The same challenges are being faced in the boardroom. The impact of a major attack can be catastrophic and the boards of many high-profile global brands have already felt the reputational and financial damage that can ensue. Many more continue to struggle to properly understand what they can do to address this and what good cyber resilience looks like for them.
THE BOARDROOM CHALLENGE
While business leaders and senior executives strive to mitigate and respond more effectively to their cyber risks, the challenge remains a big one for boards. The UK Government's annual FTS 350 Cyber Governance Health Check research published in May 2016 pinpoints many of the problems faced in the boardroom. The research, carried out with CEOs and CFOs, highlighted that:
• Only 33 per cent of boards have clearly set out and understood their appetite for cyber risk.
• Only 16 per cent have a very clear understanding of where the company's key information assets are shared with third parties.
• Over 50 per cent said: 'We listen occasionally — e.g. a bi-annual update, plus being told when something has gone wrong' in answer to the question: 'Which of the following statements best describes how cyber risk is handled in your board governance process?'
• Over 60 per cent have either not at all or only loosely defined their appetite for cyber risk, both for existing business and for new digital innovations.
In all too many boardrooms their organisation's resilience to cyber risks does not form a key part of the agenda. They remain largely 'blindsided' to the nature and impact of the risks they face and are not communicating in an informed and effective 'tone from the top' to all their people.
Consequently, many will continue to 'sleepwalk' into reacting to a crisis rather than taking adequate precautions to mitigate their risks before a crisis occurs. Personal andcorporate reputations have been irreparably damaged as a result. In the digital age, five seconds is perhaps more accurate.
Just as our technical security controls must constantly evolve and adapt to combat changing cyber threats and vulnerabilities, so we need to ensure all our people maintain their awareness learning and are provided with the appropriate, practical guidance on a continual basis that fits the needs and requirements of the organisation.
1.2 ENTERPRISE SCALE VULNERABILITY SCANNING
Dr. Neill Newman – Retail Money Market Ltd
THE BEGINNING
A number of years ago I was leading the cyber team for a medium sized organisation with a very large technology footprint, heavily regulated in multiple jurisdictions around the globe, audited to death....
My team and I had always planned to roll out internal vulnerability scanning to identify and measure what we believed were the weakest points in our processes – poor patching and configuration management. However, whenever we scoped the problem the costs/timescales looked daunting.
One day we had a visit from our regulator, who brought along their cyber assessment team; our internal 2 line risk management team also joined us. We were grilled for hours on how we were undertaking various cyber activities, a completely holistic view, then the focus of attention turned to vulnerability scanning.
External scanning was fine, systems were in place, reports generated, issues risk assessed and prioritised for remediation. "What about internal scanning?" the regulator asked. I replied that it was something we had considered, however there were no internal scanning projects at this point in time.
INTERNAL VULNERABILITY SCANNING IS NOT EASY
A few days later our 2nd line risk management team visited us again, and asked, "If you already have external vulnerability scanning, surely it's easy to switch it on internally?"
While I liked our risk guys, they obviously had no idea of the monumental complexity of this request in an organisation such as ours. Then the icing on the cake: "Can we get this in place in six months so when the regulator comes back we can say it's complete?"
I composed myself and replied that we would look into it and provide detailed plans with timescales/costs.
My team and I had a very open meritocratic communication style, with some of the best engineers I could wish for, who were highly experienced, motivated and vociferous in a positive way. After relaying the desire of our 2 line guys, and after they had shared their feelings on how absurd the request was, I asked them one question. What would it take to identify everything on our network, on an ongoing basis, as close to real time as possible?
I knew my team liked a challenge, their eyes lit up. "What about costs/resources?" they asked. "Ignore that for now, start with the basics, do it well. Tell me what it would take." was my reply. Within a few days we had a plan.
ENTERPRISE NETWORKS ARE BIG AND SCARY
To put our enterprise network into context, we had 10 data centres across the globe (US, Asia, EU), end users in 30 countries, approximately 4,000 /24 subnets, and multiple owners, administrators and legal/regulated entities all controlling access to the network.
While this is not huge compared to the likes of Amazon or eBay, it is still a world away from a small office network.
Our review of vendors' enterprise vulnerability scanners had left us underwhelmed. They often talked about "simple" processes to "identify, analyse, mitigate and manage" vulnerabilities. Both commercial and open source vulnerability scanners appeared to believe you could see all devices on the network and have perfect asset databases with nice neat network segregation.
These assumptions around "lab" conditions, where all variables are known and under control, is far from most enterprises' experience, and our organisation was no exception. In practice it is not easy to identify everything on your network using off-the-shelf offerings.
(Continues…)
Excerpted from "Managing Cybersecurity Risk"
by .
Copyright © 2018 Legend Business, Jonathan Reuvid and Individual Contributors.
Excerpted by permission of Legend Times Ltd.
All rights reserved. No part of this excerpt may be reproduced or reprinted without permission in writing from the publisher.
Excerpts are provided by Dial-A-Book Inc. solely for the personal use of visitors to this web site.
Table of Contents
Foreword John Lyons, The International Cyber Security Protection Alliance,
Preface Rt Hon Baroness Pauline Neville-Jones,
List of Contributors,
Introduction The Editor,
Part One Cybersecurity in the Information Age,
1.1 Building Business Resilience Nick Wilding, Cyber Resilience, AXELOS,
1.2 Enterprise Vulnerablity Scanning Neill Newman, Retail Money Markets Ltd,
1.3 Cybercrime – Translating the Tech from the Floor to the Boardroom Christopher Greany, Barclays Bank Group Investigations & Insider Threat Programme,
1.4 Cybersecurity: Moving from Awareness to Understanding Mark Barmby and Elliot Rose, PA Consulting Group,
1.5 How Cyber Criminals Make Money Nick Ioannou, Boolean Logical Ltd,
1.6 If SMEs are the Life Blood of the British Economy, We've Cut an Artery Brian Lord, PGI Group,
Part Two Addressing the Management Issues,
2.1 Managing Cyber Risk – The Role of the Board Richard Knowlton, Richard Knowlton Associates Ltd,
2.2 Activating the Human Firewall – The Leap from Knowing to Doing Mike Carter and Amanda Price, Layer 8,
2.3 The Resilient Organisation – Are We Searching for Our "Phlogiston"? Kev Brear and Vijay Rathour, Grant Thornton LLP,
2.4 An Action Plan for Response and Damage Containment Alexander Ellrodt, Deutsche Bank AG,
2.5 Addressing the Skills Shortage in Cybersecurity Karla Jobling, BeecherMadden,
Part Three General Data Protection Regulation,
3.1 GDPR – A View from the Frontline Chris Greenslade and John Clelland, Proteus-Cyber Ltd,
3.2 GDPR – Introducing the UK Regime Dan Hyde, Penningtons Manches LLP,
3.3 Using Scenario Workshops to Prepare for GDPR and Other Legislation Richard Preece, Oakas Ltd,
3.4 GDPR – Comparative International Regimes Dan Hyde, Pennngtons Manches LLP,
3.5 Intrusion Detection System Evaluation Guide AlienVault,
Part Four Innovative Tools for Cyber Threat Response,
4.1 Identifying Affordable and Costeffective Solutions Nick Ioannou, Boolean Logical Ltd,
4.2 Detecting Ransomware with Unified Security AlienVault,
4.3 Petya Ransomwware Rapid Response Guide AlienVault,
4.4 The Incident Response Toolkit: Putting the OODA Loop to Work in the Real World AlienVault,
Part Five Cautionary Tales from the Frontline,
5.1 The Power of Storytelling Nick Wilding, AXELOS RESILIA,
5.2 How to Avoid That 'I Told You So' Moment A real life story from AXELOS RESILIA,
5.3 A Cuckoo in the Nest? A real life story from AXELOS RESILIA,
5.4 The Trouble with Contractors A real life story from AXELOS RESILIA,
5.5 Hacked into a Parallel Universe A real life story from AXELOS RESILIA,