Magazine menu Close Magazine menu

reports

Latest stories

enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
industrial cybersecurity

What’s the state of industrial cybersecurity today?

  • min read
    • Characterized by smart manufacturing and interconnected devices, the fourth industrial revolution is here. But just like any other interconnected system, modern industrial control systems are potential targets for cyberattacks. Cybersecurity breaches can have far-reaching consequences for industrial organizations. According to The State of Industrial Cybersecurity 2019, produced by ARC Advisory Group on behalf of Kaspersky, reputational and environmental damage, injury or even death are serious risks if systems fail. And today, the stakes are becoming higher, simply because more systems are connected and dependent on one another. According to Gartner (Magic Quadrant for Industrial IoT Platforms, Eric Goodness et al., 25 June 2019, report available to Gartner subscribers): This also means there's a lot more that can go wrong, and there are many more attack vectors for cybercriminals to exploit. Many threats originate in third parties, such as suppliers, contracting firms and technology companies. And no modern industrial operation is free from risk. Why are industrial operations a target? Cyberwarfare is no longer the stuff of dystopian science fiction. It's a very real problem now that society has grown so dependent on modern technology. Attacks may be carried out by state actors, hacktivists (internet activists) – or even competitors bent on industrial espionage. With so many new avenues for attackers to exploit, such as the industrial internet of things (IIoT), it's never been more important for cybersecurity to take front and center stage in any industrial digital transformation project. Given that a nation's ability to function depends heavily on the availability of its critical infrastructure, it's easy to see why major industrial operations are popular targets. It's a highly efficient way to cripple a rival state. But it's not just state actors that the industrial sector needs to worry about. Hacktivists, who are often not associated with any particular state, may also target certain industries for political or ethical reasons. Fortunately, there's an increased focus on OT/ICS (operational technology in industrial control systems) throughout the globe to help keep industrial businesses, and the people that depend on their services, better protected. The state of industrial cybersecurity today The latest annual report The State of Industrial Cybersecurity 2019 explores the worldwide status quo and future development of industrial cybersecurity. The report uncovers what nearly 300 industrial companies and organizations think about the landscape for industrial cybersecurity today, and what measures and processes are needed to prevent cyber-incidents in critical infrastructures and industrial enterprises. Here's some of the report's key finding: We've got a people problem Despite automation, the human factor can still put industrial processes at risk: employee errors or unintentional actions were behind one in two incidents. The growing complexity of industrial infrastructures demands more advanced protection and skills. But organizations are experiencing a shortage of professionals to handle new threats and low awareness among employees. They're worried that their OT/ICS network operators are not fully aware of the behavior that can cause cybersecurity breaches, which could explain why employee errors cause half of all ICS incidents – such as malware infections – and also more serious targeted attacks. Protecting Industrial IoT and digitization In addition to a technical and awareness boost for industrial cybersecurity, organizations need to consider specific protection for Industrial IoT which can become highly connected externally: four in ten companies are ready to connect their OT/ICS network to the cloud, using preventive maintenance or digital twins. Digitization of industrial networks and adoption of Industry 4.0 standards are in the pipeline for many industrial companies. Four out of five organizations see operational network digitalization as an important or very important task for the year ahead. OT/ICS is high priority The good news? OT/ICS cybersecurity is becoming a top priority for industrial companies (87 percent). But to achieve the right protection, they need to invest in dedicated measures and highly qualified professionals to make them work effectively. Despite stating it as a priority, only just over half of companies (57 percent) have the budget they need for industrial cybersecurity. But what are the real chances of a cyberattack? Four in 10 of the businesses surveyed hadn't experienced any kind of cyberattack in the last year. But worryingly for the rest, nearly one in three haven't implemented an incident response program. Rather than keeping everything crossed, isn't it time to invest in improving your business's cyber-defenses? Just a thought…
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries