The new cyber security enterprise operating model required to survive
by Kylene Casanova
The recent Mckinsey and World Economics research into current cyber risks, and their economic and strategic implications - based on interviews and data from 200 enterprises, technology vendors and public agencies - found that there is an emerging consensus on what the cyber secure enterprise model needs to look like.
Here are the key tenets from McKinsey’s paper:
- Prioritize information assets based on business risks. Most institutions do not have enough insight into what information assets they need to protect with what priority. Going forward, cybersecurity teams need to work with business leaders to understand business risks (for example, loss of proprietary information about a new manufacturing process) across the entire value chain and prioritize the underlying information assets accordingly.
- Provide differentiated protection based on importance of assets. As Frederick the Great said, “To protect everything is to protect nothing.” Employing differentiated controls (for example, encryption, more rigorous passwords) allows institutions to focus time and resources on protecting information assets that matter the most.
- Deeply integrate security into the technology environment to drive scalability. Almost every part of the broader technology environment impacts an institution’s ability to protect itself, from application-development practices to policies for replacing outdated hardware. Institutions must move from simply bolting on security to training their entire staff to incorporate it from day one into technology projects.
- Deploy active defences to uncover attacks proactively. There is a massive amount of information available about potential attacks, both from external intelligence sources and from an institution’s own technology environment. Increasingly, companies will need to develop capabilities to aggregate relevant information and analyze and tune their defence systems accordingly (for example, firewalls).
- Test continuously to improve incident response. An inadequate response to a breach—not only by the technology team but also from marketing, public affairs, or customer-service functions—can be as damaging as the breach itself. Taking a page from the military, institutions should run cross-functional cyberwar games to improve their ability to respond effectively in real time.
- Enlist frontline personnel to help them understand the value of information assets. Users are often the biggest vulnerability an institution has—they click on links they should not, select insecure passwords, and e-mail sensitive files to broad distribution lists. Institutions need to segment users and help each group understand the business risks of the information assets they touch every day.
- Integrate cyber resistance into enterprise-wide risk-management and governance processes. Cybersecurity is an enterprise risk and has to be managed like one. Assessments of possible cyberattacks must be integrated with other risk analysis and presented in relevant management and board discussions. Moreover, cybersecurity implications should be integrated into the broad set of enterprise-governance functions like HR, vendor management, and regulatory compliance.
Like this item? Get our Weekly Update newsletter. Subscribe today