Generating ROI from cybersecurity

Pan­el:

Stephen Gra­ham, IT ser­vice direc­tor, Bif­fa

Aman­da Hamil­ton, CIO, City and Coun­ty Health­care Group

Jonathan Hope, senior tech­nol­o­gy evan­ge­list, Sophos

Anna-Lisa Miller, group CISO, Spec­tris

Gra­ham Thom­son, CISO, Irwin Mitchell

Derek Win­skill, CIO, TT Elec­tron­ics

What does the cyber threat land­scape look like in 2022, and how can CISOs and CIOs become enablers?

JH Ran­somware is the most promi­nent cyber­se­cu­ri­ty top­ic at the moment. Sophos’ research shows that while the num­ber of ran­somware inci­dents is drop­ping, the sever­i­ty of those cas­es is increas­ing. We found 37% of organ­i­sa­tions in the UK were hit by ran­somware at least once in 2021. Of those attacks, 54% were not just hit by ran­somware, but the cyber­crim­i­nals suc­cess­ful­ly man­aged to encrypt their data.

DW The board cer­tain­ly thinks ran­somware is the num­ber-one cyber threat, but there are oth­ers. We have a range of cus­tomers – from aero­space and defence sec­tors to med­ical device inno­va­tors – so we need appro­pri­ate lev­els of cyber­se­cu­ri­ty. How­ev­er, work­ing at the extreme end of secu­ri­ty means we can dial it up as required, and it improves the over­all aware­ness and capa­bil­i­ty, which assures the board and cus­tomers.

AH We have a high­ly mobilised work­force, so mov­ing to the cloud and hav­ing data quick­ly dragged into a secure envi­ron­ment mas­sive­ly reduces the attack sur­face. There should be a healthy ten­sion between CISOs and CIOs. The val­ue we pro­vide to our cus­tomers – patients – must be weighed up against pro­tect­ing per­son­al infor­ma­tion. The rela­tion­ship must be strong and the con­ver­sa­tion con­stant. It’s more than agree­ing on a frame­work reviewed every six months. SG Biffa’s cyber­se­cu­ri­ty is entire­ly in the cloud, too. It enables us to have a sin­gle view of our devices and means we can scale at will. Oper­at­ing in the cloud makes it eas­i­er to have mul­ti­ple back­ups of net­work data, pro­tect­ing us against ran­somware and oth­er threats. But our biggest chal­lenge is the behav­iours and abil­i­ties of the end-user, so increas­ing edu­ca­tion is crit­i­cal.

ALM The threat land­scape is con­stant­ly evolv­ing, so you need to cov­er as many bases as pos­si­ble – and that includes think­ing holis­ti­cal­ly about your sup­ply chain. The most cru­cial thing is to under­stand why you might be a tar­get, who is most like­ly to attack you and why. It’s also impor­tant to remem­ber, espe­cial­ly with geopo­lit­i­cal ten­sions, that there is a risk of becom­ing col­lat­er­al dam­age in an unex­pect­ed way.

GT The IBM Cost of a Data Breach 2021 report, pub­lished in Decem­ber, showed ran­somware is the top threat by oper­a­tional impact and fac­tored in 7.8% of glob­al breach­es last year. For UK busi­ness­es, ran­somware inci­dents cost an aver­age of £1.5m. It’s worth not­ing, though, that the most com­mon breach­es are from logins with stolen pass­words – 1.5% of all login cre­den­tials glob­al­ly have been com­pro­mised, accord­ing to Google. But it’s sim­ple to mit­i­gate most of this risk just by acti­vat­ing mul­ti-fac­tor authen­ti­ca­tions on all online accounts. We have a vest­ed inter­est in help­ing our sup­pli­ers as well as clients with cyber hygiene.

To bet­ter man­age the evolv­ing cyber threat land­scape, out­sourc­ing and col­lab­o­rat­ing are crit­i­cal – how should these part­ner­ships work?

JH The appetite for busi­ness­es to move to an out­sourced mod­el is increas­ing because there are so many things to mon­i­tor. If you buy secu­ri­ty prod­ucts from dif­fer­ent ven­dors, it can be time-con­sum­ing to look across var­i­ous dash­boards. It makes bet­ter sense to invest in cyber­se­cu­ri­ty where it’s all in one place. The return on invest­ment is giv­ing back your peo­ple time.

DW I have a glob­al team span­ning Asia, Europe and the Unit­ed States and don’t have enough cyber­se­cu­ri­ty resources, so out­source things like threat mon­i­tor­ing, secu­ri­ty inci­dent and event log­ging. This approach has dri­ven inno­va­tion, as we can lever­age the expe­ri­ence of the expert part­ners. Automa­tion and arti­fi­cial intel­li­gence tools are essen­tial – we bin 93% of sus­pi­cious emails that come into the organ­i­sa­tion before they reach the end-user.

GT Some things are bet­ter man­aged in-house, but you will always need pro­fes­sion­al help. Secu­ri­ty automa­tion with AI and machine learn­ing has been shown to reduce breach­es and inci­dents and, if a breach does occur, cut costs by 80%. Also, it takes a third less time to detect and mit­i­gate inci­dents with automa­tion in place. Addi­tion­al­ly, hav­ing zero trust archi­tec­ture can reduce the cost of the breach by 35%.

AH I don’t have AI experts in my team. So I look for fan­tas­tic part­ners who can bring cut­ting-edge solu­tions to the table. A hybrid approach leads to an ROI and inter­est at the board lev­el because of the rep­u­ta­tion­al pro­tec­tion we can pro­vide by spend­ing X instead of Y.

ALM When you’re out­sourc­ing, it’s vital to con­sid­er nur­tur­ing a part­ner­ship, rather than just chuck­ing a load of risk over the fence to some­body else – because you still own that risk. We are all on the same team, we have shared objec­tives, and antic­i­pate risks and oppor­tu­ni­ties togeth­er.

SG Unless you’ve writ­ten your own antivirus soft­ware, you’ve always out­sourced. It’s just about work­ing out the right bal­ance. We out­source a lot, rely on con­trols and patch­ing brought to us by third-par­ty organ­i­sa­tions, and knowl­edge and input from gov­er­nance bod­ies.

What are the best ways CIOs and CISOs can gain greater sup­port from the C‑suite to reduce cyber risk?

SG Bif­fa is not a bank, so we don’t need the high­est lev­els of cyber­se­cu­ri­ty. But we are inno­v­a­tive, and we want to shake hands with our sup­pli­ers who can improve our oper­a­tion. By join­ing the dots between com­pli­ance, our sup­pli­ers, and the cus­tomers, we can show Bif­fa is more secure than our com­peti­tors, which will gain top-lev­el buy-in.

DW Now, when the organ­i­sa­tion is choos­ing a new loca­tion for a fac­to­ry, we send our head of infor­ma­tion secu­ri­ty, giv­ing the busi­ness an extra lay­er of pro­tec­tion. This busi­ness-focused secu­ri­ty oper­a­tion res­onates well with exec­u­tives. It takes a task off their plate and pro­vides insight into how we are think­ing, which grad­u­al­ly helps increase secu­ri­ty edu­ca­tion and aware­ness.

AH The days when you had ivory tow­er IT func­tions that set all the rules in a com­mand-and-con­trol style are gone. Instead, the tech­nol­o­gy func­tions with­in organ­i­sa­tions are mas­sive facil­i­ta­tors, both for change and secu­ri­ty. I now look to hire peo­ple who, yes, have deep tech­ni­cal skills but also pos­sess strong stake­hold­er man­age­ment and busi­ness analy­sis skills so that they can be solvers, not block­ers.

GT Ulti­mate­ly, the ROI on cyber­se­cu­ri­ty is all about cost avoid­ance. It’s about not hav­ing your com­pa­ny rep­u­ta­tion trashed because you can’t keep your house secure, and as a law firm, this is par­tic­u­lar­ly impor­tant. To prove the busi­ness case, you need to mea­sure the right things and make them under­stand­able for deci­sion-mak­ers.

ALM There are inter­de­pen­den­cies between strat­e­gy, val­ues, and cul­ture, all rein­forced by secu­ri­ty. When talk­ing to deci­sion-mak­ers, you have to demon­strate a gen­uine depth of knowl­edge and under­stand­ing of the busi­ness and show how the secu­ri­ty strat­e­gy fits. You won’t have much time with the board or exec­u­tive, so dis­til your mes­sages, but this is where the con­ver­sa­tion needs to be.

JH Per­suad­ing the board to spend mon­ey on secu­ri­ty will be a chal­lenge, but every­one now under­stands the impor­tance of cyber­se­cu­ri­ty. Using automa­tion tech­nol­o­gy to free up resources and reduce risk will pro­vide an ROI. As a clas­sic fall­back option, if all else fails, you could paint an alter­na­tive pic­ture show­ing the risk of not hav­ing ade­quate cyber­se­cu­ri­ty and suf­fer­ing irrepara­ble dam­age.

For more infor­ma­tion, vis­it sophos.com/en-us