Year: 2018

Managing risk is at the forefront of responsibilities that C-level executives deal with on a daily basis. Yet, many executive committees are still ignorant of security risk due to a lack of understanding or an unwillingness to take the time to learn the risks. What are the key questions executives, board members and audit committee members should ask themselves regarding how security risk is managed within their organization?

What do we see?

Over the past 10 years there has been a dramatic increase in the number of security incidents. To give just one example; in just 10 years (2006-2015), the US government saw a 1300% increase of cyber security incidents. 2016 and 2017 have only confirmed this trend with a staggering number of data breaches, ransomware attacks, phishing incidents, etc. Not surprisingly, security risk has claimed a top spot in the top business risks in many, if not all, industries. Company boards and executive committees can no longer ignore the fact that just one serious security incident could significantly impact the bottom line and future growth of their company, and potentially even cost them their jobs.

The good news is that managing risk is at the forefront of responsibilities that C-level executives deal with on a daily basis. Managing business risk, and even firefighting, is part of the job description, and planning to prevent the fires is what successful companies do. Hence, CEOs and other members of the C-suite should be well versed in dealing with risks, including security risks.

Yet, both the security incidents as research seem to indicate that many executives are not ready, nor set up to manage security risks:

• A recent report by F5 Networks found that although 65% CISOs say they report to senior executives, most often that reporting is limited to incident and crisis reporting. It also indicates that 35% is not even reporting on that.
• A 2016 reportfrom Nasdaq and Tanium states more than 90% of corporate executives say they can’t read a cyber security report and aren’t prepared to handle a major attack.
• Severe data breaches already cost the jobs of CEOs (e.g. Equifax and Target). However, it is more likely (though less reported) that the CISO takes the fall. After all, isn’t the CISO responsible and accountable for security? While this may seem a logical reasoning, it negates the fact that security is a shared responsibility across the company and that there are many times that the security requirements and the CISO are ignored. Additionally, I would like to quote a question of Wim Remes, Chairman of the Board of the International Information System Security Certification Consortium, or (ISC)²: “You don’t fire your general counsel when you get sued, so why would you fire your CISO when you get breached?” So, without looking into the individual cases, but just at the trend, blaming and even firing the CISO seems to be one other indication that there is still a major disconnect between the CISO and the CEO.

Basically, it comes down to this: when the CEO (and by extension the executive committee and the board) is ignorant of security risk due to a lack of understanding or an unwillingness to take the time to learn the risks, then:

• Important decisions about security do not get made
• The CISO is not enabled, nor empowered to successfully help protect the company
• The company is not prepared for the many and ever increasing security risks it is facing

6 key questions executives should ask themselves

As C-level executive, board member or audit committee member there are a number of key questions you should ask yourself about the manner in which security risk is managed is in your company.

1. Does your CISO have both the organizational and positional power to escalate issues that they feel strongly about to the appropriate C-level or even board position?

Your CISO will not be successful unless he or she has the buy-in and engagement of the executives. Without this, your CISO will simply be perceived as a business blocker and his or her efforts circumvented. Your CISO needs to have the organizational power and position to effectively challenge business risk decisions that are not good for the company.

2. Are you a passive listener to what your CISO has to say or do you actively engage in the conversation? Are you demanding the latter also from the other execs?

An involved CEO meets regularly with the CISO, reviews reports, asks questions, and provides encouragement and support in front of the other executives and board.

3.  Do you know what your security policies are about, what their objectives are, and do you understand that they help to define the level of risk you are willing to take as a company.

As executive you must actively endorse and support the security policies, and not just passively agree to them as a mere formality. If you don’t bother or don’t believe in enforcing the security policies that were put in place to protect your company’s information (systems), if you don’t help to enforce the policies that you let down your company, your employees, your suppliers, your customers, …, then you probably deserve the security incidents that will inevitably occur.

4. Are you considering security as a responsibility and accountability that is shared across the company or are you attributing it completely to your CISO and his or her security team?

Controlling security can’t be relegated to one person or one team. It’s an enterprise risk and business problem, not just a CISO problem to resolve. It should not be the CISO making all the decision as to how much investment and what the right thing to do is. That actually needs to be in the hands of the Executive Committee. The CISO obviously plays a facilitating role and you can make a CISO responsible for particular security tasks, but a CISO can never be held accountable for security tasks and responsibilities of others. You should therefore –    with the help of your CISO – institute a security program that engages all different stakeholders in the company. Clear assignment of responsibilities is vital. Groups who are responsible for protecting crucial data, like IT, HR, procurement, and marketing, must become cyber-conscious and accountable too.

5.  Are your discussions on executive and board level driven by front page news and incidents?

As information security breaches continue to make the front pages, organizations need to ensure that headlines don’t drive the information security program. Ensure your CISO has regular interactions with executive leadership to create clear visibility into all areas of security risk, i.e. a structured form of risk reporting allowing you to manage security risks in a forward looking and business strategy-aligned manner.

6.Do you believe security problems can be solved by simply investing in the right security tools and solutions?

Incident driven security risk discussions tend to result in throwing money at the issue and investing in new security solutions.  However, and to quote Tim Holman, past president of the Information Systems Security Association in the UK (ISSA-UK): “The cyber threat cannot be solved by buying products. A common-sense approach of reducing the amount of sensitive data stored, booting out insecure suppliers, restricting access to information and getting cyber liability cover will often be ten times as effective and ten times cheaper than the next generation security appliance with flashing lights sold to you by expert salesmen. All these require support from the lines of business and the executives.”

Not sure where your company currently stands?

Did the previous questions make you realize it is time to talk to your CISO? Good, then here are some questions that you should ask him or her to trigger a critical discussion about the state of security risk within your company:

1. Do you understand our wider business strategy?
2. (How) have you aligned our security approach to our organizational strategy?
3. What are the biggest risks?
4. What are the gaps?
5. How are you evolving our security approach to match the changing risk landscape?
6. Are sufficient resources available, and are they being used wisely?
7. Are you being heard? If not where and why are people ignoring you?

Based on the answers you are getting, you will be able to see where the lines of communication between CISO and executives are obscured, where the CISO may not have been given the tools and resources in line with his or her responsibilities, and – most importantly – if and where you need to improve your understanding of security risk to the same degree as any other business risk.

Tim Wulgaert is a consultant, advisor, presenter and author in the field of information security and privacy. He has over 15 years of experience in developing, reviewing and improving information security strategies, policies, awareness campaigns, organizational design and other related security management topics. Currently, Tim is working on securitythisway.com; an initiative to build a security management content platform that aims to provide security and privacy professionals with hands on security policy, process, awareness and other related security management content.

Source: https://www.csoonline.com/article/3241466/governance/dear-ceo-are-you-enabling-your-ciso.html

Cybersecurity has traditionally been a subject only a few executives were expected to understand. However, as additional security concerns are spreading across businesses, cybersecurity now concerns all members of the C-Suite. For example:

• The chief financial officer needs to ensure secure transactions between financial institutions or business partners.
• The chief marketing officer needs to master how to securely leverage digital and social media without putting the organization at risk.
• The chief human resources officer needs to know that digital recruiting processes are secure and personal data won’t be compromised.

Cybersecurity concerns and capabilities for each managing function should be harmonized under companywide priorities and principles. This presents new opportunities for the Chief Information Security Officer (CISO). To get to this point, the organization needs to establish these key processes:

1.  The CISO needs to interact directly with all C-Suite members.
2.  The  C-Suite needs to agree on what the company wants to do from a holistic perspective.
3.  The CISO needs to facilitate these discussions.

To facilitate these critical conversations in the C-Suite, the CISO should be prepared to ask the following questions:

• What are the crown jewels we want to protect with the highest priority?
• What are the business consequences if those crown jewels are stolen?
• How much are we willing to invest to mitigate those risks?

Integrating cyber-resilience solutions

Across each organization, there can be many solutions to address cyber resilience. A technology solution could be managed-security services; a financial solution could be cyber insurance; an operational solution could be a Computer Security Response Team (CSIRT); a legal solution could be fiduciary actions based on the advice of attorneys.

The key is to integrate these solutions into a cybersecurity strategy that supports the business priorities of the company. Many companies have not defined and assigned a person to lead that effort. This is a new space in corporate business management—and a new opportunity for the CISO.

Conclusion

By taking on the cybersecurity leadership role in the C-Suite, a CISO can develop and drive a cybersecurity strategy that becomes a comprehensive and integrated package, rather than an aggregation of independent tactics. It can be owned by the entire C-Suite and woven into the companywide business strategy. This will help to reduce risk and improve cyber resilience.

Shinichi Yokohama

Source: https://www.securityroundtable.org/cybersecurity-leadership-role-sweet-spot-ciso/

Critical digital and physical assets are becoming increasingly vulnerable due to accelerated connectivity, differing global regulatory requirements, joint ventures and business partnerships and security weaknesses within complex multinational supply chains. These factors have led to a rise in insider threats for enterprises across all industries.

An insider threat is an employee or third-party vendor that has access to a company’s network. While some insiders seek to compromise sensitive corporate data for monetary gain or out of spite, others do so accidentally due to negligence or lack of awareness.

According to the “2016 Insider Threat Report” by Crowd Research Partners, 75 percent of survey respondents estimated insider threats cost their companies at least $500,000 in 2016, while 25 percent reported costs could exceed that amount. The study also found that 74 percent of organizations are vulnerable to insider threats. Of that number, 7 percent reported that they were “extremely vulnerable.”

Common Behavioral Indicators

The most common indicator of an insider threat is lack of awareness. For instance, employees with savvy IT skills often create workarounds to technology challenges. When employees use their own personal devices to access work emails, they often create new vulnerabilities within the organization’s physical security processes and IT systems.

The chief information security officer (CISO) must be aware of these patterns to detect suspicious motives, which requires a holistic and layered approach to user behavior analytics (UBA). The following are examples of behavioral indicators:

1. Downloading substantial amounts of data to external drives;
2. Accessing confidential data that is not relevant to a user’s role;
3. Emailing sensitive information to a personal account;
4. Attempts to bypass security controls;
5. Requests for clearance or higher-level access without need;
6. Frequently accessing the workspace outside of normal working hours;
7. Irresponsible social media behaviors;
8. Maintaining access to sensitive data after termination;
9. Using unauthorized external storage devices;
10. Visible disgruntlement toward employers or co-workers;
11. Chronic violation of organization policies;
12. Decline in work performance;
13. Use of mobile devices to photograph or otherwise record computer screens, common work areas or data centers;
14. Excessive use of printers and scanners;
15. Electronic communications containing excessive use of negative language;
16. Installing unapproved software;
17. Communication with high-risk current or former employees;
18. Traveling to countries known for intellectual properly (IP) theft or hosting competitors;
19. Violation of corporate policies;
20. Network crawling, data hoarding or copying from internal repositories;
21. Anomalies in work hours;
22. Attempts to access restricted areas;
23. Indications of living beyond one’s means;
24. Discussions of resigning or new business ventures; and
25. Complaints of hostile, abnormal, unethical or illegal behaviors.

Remediation Pain Points

Insider threats are costly to remediate because they are very difficult to detect. A thorough investigation often requires companies to hire forensic specialists to determine the extent of a breach. It is also challenging to distinguish malicious activity from regular day-to-day work. For example, users who have elevated access privileges interact with sensitive data as part of their normal jobs, so it can be virtually impossible to determine whether their actions are malicious or benign.

Users who have elevated access privileges often cover their tracks by deleting or editing logs, impersonating another user or using a system, group or application account. Proving guilt is yet another pain point, since offending users may claim ignorance or human error.

Steps to Combat Insider Threats

Most organizations lack procedures to deal with internal threats. Moreover, security architecture models have no room for insider threats. Security infrastructures primarily prevent outside attackers from gaining entrance to the network undetected, operating under the false assumption that those who are granted internal access in the first place are trustworthy.

To properly account for and remediate insider threats, organizations must establish a comprehensive, risk-based security strategy that includes the following four elements:

1. Information Governance

It is of paramount importance to protect critical data assets from insider threats. Information governance provides business intelligence that drives security policies and controls. This improves risk management and coordination of information management activities. A solid information governance foundation enables organizations to adopt a risk-based approach to protecting their most valuable assets and installing sound data management procedures.

2. Advanced Forensic Data Analytics

User-based analytics are indispensable tools that provide detection and predictive measures to thwart insider threats. These solutions incorporate artificial intelligence and machine learning technologies that objectively analyze insider behaviors and generate risk rankings within the user population.

3. Incident Response and Recovery

External and insider breaches have their own nuances, but the impacts are similar and should leverage the same response program in anticipation of a major breach. Organizations must strive to build as strong an insider threat program as possible. It’s also important to develop an incident response program that considers both internal and external breaches.

4. Legal Considerations

An insider threat program cannot be successful without careful legal and regulatory considerations. For example, privacy laws pertaining to employee monitoring vary across national boundaries. In the U.S., the Electronic Communications Privacy Act (ECPA) allows employers, under certain provisions, to monitor their employees’ emails and other electronic communications. Meanwhile, the member states of the European Union (EU), in compliance with the European Convention on Human Rights, adhere to privacy laws under the Data Protection Directive, which regulates how organizations within the EU process personal information.

A Cross-Organizational Challenge

Combating insider threats is an organizational issue that crosses people, processes and technology and requires a detailed understanding of the organization’s assets and security posture. It also demands a clear separation of duties, continuous monitoring of employee behaviors and a formal insider threat program that includes IT, human resources, legal and all other business groups. With the proper resources in place, a CISO can gather the actionable intelligence needed to thwart internal attacks and gain visibility into the highest-risk users.

George Moraetes

Source: https://securityintelligence.com/the-cisos-guide-to-managing-insider-threats/