Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Assessment

7/11/2017
12:30 PM
Ray Le Maistre
Ray Le Maistre
Ray Le Maistre
50%
50%

Cybersecurity: More a People Than a Tech Challenge?

When it comes to cybersecurity strategies, the human angle needs to be brought to the fore, according to BT and KPMG.

With so many high-profile attacks impacting companies, governments and organizations around the world, awareness of cybersecurity threats has never been higher -- but that doesn't mean companies have a suitable security strategy, or even feel they need one at all, according to experts at BT Group plc (NYSE: BT; London: BTA) and consultancy KPMG LLP. (See Petya Ransomware Takes the World by Storm and Unknown Document 732861.)

The two companies have just issued a report, entitled "The cyber security journey -- from denial to opportunity," which aims to highlight some of the key challenges facing all types of enterprises and institutions in the modern era and make suggestions about how to overcome those challenges. (See Unknown Document 734391.)

The report identifies five steps on the cybersecurity maturity journey -- Denial, Worry, False Confidence, Hard Lessons and becoming a True Leader -- and digs into each of those with examples and recommendations. That might sound a bit corny, but the stages are well explained (and will likely resonate with many) and the recommendations are clear and simple without being patronizing. They also highlight that the major cybersecurity challenges are related to people, not technology.

A couple of key messages stand out from the report.

First, that any company, of any size and in any sector, is under threat –- "it won't happen to us" is the cry of the deluded. "A lot of CEOs don't realize that cybersecurity threats are commoditized … Even if your company is not being specifically targeted by cyber criminals, you still need to defend against the commoditized threats" such as the recent extensive ransomware attacks, noted David Ferbrache, technical director at KPMG's cybersecurity practice, during a recent media briefing at BT's cybersecurity facility in Sevenoaks, UK.

Second, for those organizations that identify the need to protect themselves against cybersecurity threats (some, amazingly, still believe they are immune), simply investing in security technology such as firewalls is not enough. "Security technology is not a silver bullet," said the CEO of BT Security, Mark Hughes. (No, not THAT Mark Hughes…)

"Don't start [a cybersecurity strategy] with the technology!" he advised.

In fact, throwing money at the latest security tech can lead to unwelcome attention, including, the two companies noted in their official announcement of the report, from "over-zealous IT salespeople." (Editor's note: That's the first time I have laughed at a press release in 20 years…)

What is needed before any action is taken, according to Hughes and Ferbrache, is a rational assessment of existing security procedures and a decision about what it is that matters most to a company -- what needs to be protected above all else. "It's possible that companies can spend a lot of money and not actually secure what is valuable to them," noted the KPMG man.

All of which requires agreement from all levels within a company or organization, particularly from the top management, that cybersecurity is actually important and strategic. The research conducted for the report suggests this is not currently the case: BT's Hughes noted that 68% of CEOs surveyed don't regard security to be part of their digital transformation processes, "which is surprising," he noted.

BT Security CEO Mark Hughes: 'Don't start with the technology!'
BT Security CEO Mark Hughes: "Don't start with the technology!"

A more favorable scenario would involve a senior executive -- a chief information security officer (CISO) if the company is large and well resourced enough -- taking responsibility for a security strategy and, importantly, engaging with the rest of the business or organization and not working in isolation. "Too often I hear chief security officers refer to 'the business' as if they are not part of it… but they are a key part of the business and all the moving parts need to work together," stated Hughes.

And to be truly effective, that security officer needs to not only engage internally and clearly communicate a security strategy (including what to do when security defenses are compromised), but also engage and learn from the broader community, from others that are also implementing a strategy and may have been subject to attacks and breaches. "There are lots of hard lessons to be learned," stated Hughes.

That, of course, applies to Hughes as it does any other head of security: He says he talks with his peers from other major telcos, such as AT&T, Deutsche Telekom, Orange and Verizon, about best practices, current threats and the future. Current conversations include the impact of 5G on security procedures, noted the BT man.

Both BT and KPMG have skin in this game, of course -- KPMG offers security strategy consultancy and BT provides a range of security services built upon its own network security capabilities -- but the two companies have managed to produce a report that is useful without coming across as a sales pitch. The report can be downloaded here. (See Unknown Document 733496 and Unknown Document 723014.)

— Ray Le Maistre, Circle me on Google+ Follow me on TwitterVisit my LinkedIn profile, International Group Editor, Light Reading, for Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Data Breaches Affect the Enterprise
Data breaches continue to cause negative outcomes for companies worldwide. However, many organizations report that major impacts have declined significantly compared with a year ago, suggesting that many have gotten better at containing breach fallout. Download Dark Reading's Report "How Data Breaches Affect the Enterprise" to delve more into this timely topic.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20859
PUBLISHED: 2021-12-01
ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-19...
CVE-2021-20860
PUBLISHED: 2021-12-01
Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and ...
CVE-2021-20861
PUBLISHED: 2021-12-01
Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC...
CVE-2021-20862
PUBLISHED: 2021-12-01
Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-175...
CVE-2021-20863
PUBLISHED: 2021-12-01
OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GS...