Leading a digital trust movement

The UK government’s recent inves­ti­ga­tion into the total cost of cyber­crime put into con­crete terms a con­cern that will come as no sur­prise to many IT teams. The inves­ti­ga­tion observed that mali­cious cyber attacks now cost the UK econ­o­my an eye-water­ing £27bn per year.
Although stag­ger­ing, acknowl­edg­ing the sheer scale of the prob­lem may come as a relief to many put-upon secu­ri­ty teams that feel they are under 24-hour siege.

Busi­ness­es are start­ing to embrace an all-hands-on-deck approach. Just as a house with a locked front door is nev­er safe while a win­dow is left open, a CISO can only keep an organ­i­sa­tion safe and main­tain the dig­i­tal trust of con­sumers if all staff are involved in cre­at­ing a ring of steel against cyber threats.

“Involv­ing all staff will estab­lish a more diverse and effec­tive cir­cle of pro­tec­tion,” states Tony Hugh­es, direc­tor of cyber­se­cu­ri­ty con­sult­ing at ANSEC and ISACA mem­ber. “Any organ­i­sa­tion needs lots of peo­ple who don’t think like each oth­er to iden­ti­fy dif­fer­ent risks and set­tle them as quick­ly as pos­si­ble.”

Deploy­ing a holis­tic secu­ri­ty pos­ture across depart­ments requires a com­pa­ny-wide com­mit­ment. But despite their piv­otal posi­tion, many CISOs do not feel empow­ered to lead col­lab­o­ra­tive defences. In a recent sur­vey of 2,755 glob­al busi­ness and IT pro­fes­sion­als, ISACA found that only half felt there was suf­fi­cient col­lab­o­ra­tion at their organ­i­sa­tion to pro­mote dig­i­tal trust.

With the accel­er­at­ed pace of hyper­con­nect­ed busi­ness, organ­i­sa­tions face new con­sid­er­a­tions for estab­lish­ing and sus­tain­ing dig­i­tal trust and trans­for­ma­tion — but one won’t hap­pen with­out the oth­er. IT lead­ers acknowl­edge this as 76% agree that dig­i­tal trust is impor­tant to dig­i­tal trans­for­ma­tion.

Work­ing more open­ly can help CISOs plug sub­stan­tial gaps across teams. Most busi­ness-crit­i­cal prob­lems, even tech­ni­cal ones, have a sig­nif­i­cant human com­po­nent which can only be mit­i­gat­ed by mak­ing staff them­selves more resilient against an attack.

Before the pan­dem­ic, secu­ri­ty lead­ers large­ly over­saw how busi­ness­es utilised tech­nolo­gies to oper­ate more than the peo­ple behind those oper­a­tions. “Sweep­ing change has come about because peo­ple need the rel­e­vant skills and train­ing to run tech­nolo­gies secure­ly and effec­tive­ly,” says Ram­ses Gal­lego, CTO at Cyber­Res and ISACA mem­ber. “Peo­ple who are empow­ered to do so will become cyber­se­cu­ri­ty advo­cates and encour­age oth­er employ­ees to take on rel­e­vant train­ing to avoid dis­rup­tion and set the busi­ness up for suc­cess.”

His­tor­i­cal­ly, CISOs have relied upon their devel­op­er or engi­neer­ing back­grounds, focus­ing exten­sive­ly on the tech­ni­cal side of secu­ri­ty. But strate­gi­cal­ly speak­ing, mod­ern secu­ri­ty lead­ers have more to bring to the table. “In today’s com­plex econ­o­my, with dig­i­tal trust mak­ing or break­ing an enter­prise, CISOs need to bring not only tech­ni­cal exper­tise but also strong busi­ness acu­men and the abil­i­ty to clear­ly com­mu­ni­cate risk to the board and C‑suite,” says Chris Dim­i­tri­adis, chief glob­al strat­e­gy offi­cer at ISACA. “Today’s CISOs must view them­selves as a key busi­ness enabler that, by align­ing secu­ri­ty strat­e­gy with enter­prise goals, helps to make secu­ri­ty a dri­ving force of the enterprise’s ongo­ing pur­suit of dig­i­tal trust.”

On top of fight­ing cyber apa­thy, reduced bud­gets and chang­ing busi­ness pri­or­i­ties, CISOs must seek sup­port from oth­er areas of the busi­ness. Bring­ing in risk-aware depart­ments and engag­ing the entire width of the C‑suite can fos­ter cyber resilience across depart­ments regard­less of tech­no­log­i­cal know-how, says Allan Board­man, founder of CyberAdvisor.London and ISACA mem­ber.

“Any depart­ment that holds employ­ee or con­sumer data is at risk,” says Board­man. “As a first pri­or­i­ty, busi­ness­es need to get the fun­da­men­tals right and encour­age all employ­ees – whether they work in HR, oper­a­tions, or mar­ket­ing – to sign up to good secu­ri­ty prac­tices, so they know what to look out for, what to avoid, and how to report any unusu­al activ­i­ty.”

Get­ting an entire organ­i­sa­tion row­ing in the same direc­tion is a chal­lenge for the ages. In order to rise to the occa­sion, the CISO must be at the fore­front of change. The hard work on mit­i­gat­ing cyber risk must extend beyond the IT and secu­ri­ty teams to per­me­ate every facet and func­tion of the organ­i­sa­tion at every lev­el.

To learn more, vis­it isaca.org/digital-trust

The UK government’s recent investigation into the total cost of cybercrime put into concrete terms a concern that will come as no surprise to many IT teams. The investigation observed that malicious cyber attacks now cost the UK economy an eye-watering £27bn per year.
Although staggering, acknowledging the sheer scale of the problem may come as a relief to many put-upon security teams that feel they are under 24-hour siege.

Businesses are starting to embrace an all-hands-on-deck approach. Just as a house with a locked front door is never safe while a window is left open, a CISO can only keep an organisation safe and maintain the digital trust of consumers if all staff are involved in creating a ring of steel against cyber threats.

“Involving all staff will establish a more diverse and effective circle of protection,” states Tony Hughes, director of cybersecurity consulting at ANSEC and ISACA member. “Any organisation needs lots of people who don’t think like each other to identify different risks and settle them as quickly as possible.”