Why It’s Time Boards Treated Cyber Security Risk Like Financial Risk
With the relentless flow of high-profile security breaches, there is no doubt that boardrooms around the world have woken up to the threat that cyber-attacks pose to their businesses. Boards know that they are now accountable and will be judged by their ability to protect their organisations against financial and reputation loss as a result of cyber security failures, writes Ian Glover, president, CREST.
Boards are pivotal in improving the levels of corporate-wide cyber security and are responsible for managing cyber security resilience and providing confidence to stakeholders in the business that levels of control are commensurate and appropriate.
However, according to the National Cyber Security Centre (NCSC), one of the most frequently asked questions by board members is, “how do we know what ‘good’ looks like for cyber security?”
The simple answer is that good cyber security is whatever protects the things you care about and ‘good’ cyber security for one organisation may not be good for another. So, boards need to draw on the knowledge and expertise of others to make the right judgements.
The Board is responsible for many other risk related activities where qualitative analysis and professional opinion are used to support its decisions. The cyber security industry must find a way of replicating the mandatory formal risk Board reports. To do this we must have standards in place and establish suitably qualified individuals capable of providing structured defendable opinions.
You would not just employ a company to provide formal risk reports on financial risk management; you would expect suitably qualified individuals to provide an opinion to the Board and to other stakeholders as part of the regulatory audit and review process. Those signing off these Board reports carry an obligation and would have to stand up and be accountable should it be proved that they had not identified bad or illegal practices. The cyber security industry must move in this direction if is to be viewed as a parallel profession.
The role of pen testing
The best way to discover where vulnerabilities lie and how they can be exploited is to simulate malicious attacks, from inside or outside of the organisation, in order to see how easy it is to break into a network or computer system and steal valuable data or deny access to critical assets. This is the art of penetration testing that provides an indication of the level of resilience that the organisation has against technical cyber security attacks.
Of course, it is recognised that no organisation can 100% secure against attack and there is a significant difference between the capability of an individual downloading a basic attack tool from the internet to the capability of serious organised crime or hostile intelligence services. Therefore, the level of technical control that is appropriate will also vary, which means that the recommendations from a penetration test must be placed in context to the capability of the potential attacker. This is essential if the results of the penetration test are to be used to form an opinion to be formally put forward to the Board and other stakeholders.
Also read: 4 easy guides to data breach assessment
Cybersecurity and the board: The technical cyber resilience opinion
It may be the case in the future that senior penetration testers will be formally asked for their opinion on the appropriateness of the technical controls, which is likely to form a core part of the overall Board Cyber Resilience report. As an industry, those responsible for technology often like to be in a position to set formal targets or KPIs, often backed by ‘the maths’. This is not often the case with other opinion-based Board reports. It is not the case that a key performance indicator would be measured against the number of unsuccessful attempts at fraud or money. This is why the opinion is so important. Therefore, indicators based on statistics such as the number of successful or prevented attacks and breaches are interesting from a headline perspective but are often not very useful as a demonstration that the organisation has in place appropriate and commensurate cyber security controls.
The purpose of a Cyber Security Resilience Opinion would be to produce cyber security statements that provide information about an organisation’s cyber security resilience position for stakeholders and decision makers. Unlike some other aspects of the business, resilience against attack is often a very technical issue and therefore we must find a way of describing the technical cyber security controls to a wide range of stakeholders. Whilst the stakeholders range from the board to investors, suppliers and customers, the question about resilience against attack balanced against corporate spend is almost the same.
To provide the same degree of confidence as financial or legal opinions, the cyber security resilience opinion must be provided by qualified external experts with a detailed understanding of technology with the ability to contextualise this in terms of supporting security activities and business needs. They need be engaged to examine the technical cyber security position and to give their professional view on whether management have taken appropriate and justified steps to protect the information systems they are responsible for over given periods.
Penetration testing is essential to prove that the controls in place are providing an appropriate level of protection, while cyber threat intelligence will help to contextualise the controls in relation the type of attackers and their capability. The Security Operations Centres (SOCs) are on the front line of defence and their ability to identify and triage attacks is essential. The ability to act on information about potential or actual attacks is really important and will often require the support of trusted third parties. All of these aspects will be essential parts of the overall Cyber Security Resilience Opinion. The business needs to be confident and very clear who they are dealing with and have trust in professionally qualified and skilled individuals with the appropriate processes and methodologies to protect data and integrity.
CREST – the not-for-profit body that accredits companies and certifies individuals providing penetration testing, cyber incident response, threat intelligence and security operations centre (SOC) services – already provides this level of trust and confidence for the board and wider buying community.
The cyber security industry has also been working with business and governments to further professionalise the industry. CREST is working with all the other major industry bodies that support the cyber security industry and the NCSC and DCMS to set up a Cyber Security Council, which when established will provide Chartered status for professionals working in cyber security to be aligned with other professions such as accountancy, law and engineering. It is the view of CREST that this professional Chartered Status should be the benchmark for individuals providing opinions on Cyber Security Resilience.
Meanwhile, specific industries such as banking and financial services, aviation, telecommunications, and energy, are setting up their own schemes. The first of these was CBEST, developed by the Bank of England (BoE) and supported by CREST. This is a framework to deliver controlled, bespoke, intelligence-led cyber security tests that replicate behaviours of those threat actors, assessed by Government and commercial intelligence providers as posing a genuine threat to systemically important financial institutions. The inclusion of specific cyber threat intelligence ensures that the tests replicate as closely as possible the evolving threat landscape and therefore will remain relevant and up to date.
Most recently, the Civil Aviation Authority (CAA) has introduced its new ASSURE scheme developed in partnership with CREST, to play a key role in the CAA’s Cyber Security Oversight strategy. It enables the aviation industry – including airlines, airports and air navigation service providers – to manage their cyber security risks without compromising aviation safety, security or resilience and to support the UK government’s National Cyber Security Strategy. Questionnaires completed by the regulated organisations are validated by accredited penetration testers who provide a report to the CAA as the Regulator and then the CAA provides an opinion. This is only one step away from delivering a Technical Cyber Security Resilience Opinion.
A company’s Annual Report is typically made up of audited financial statements and a narrative, containing management’s description of the company’s performance and activities. Whilst there are moves to include cyber security as part of the Annual Report, this is not currently a requirement. However, given that the report should provide confidence to shareholders and other stakeholders in the resilience of the organisation, the inclusion of a Cyber Security Resilience Opinion would be a good starting point for this type of assurance.
Also read: 9 Policies For Security Procedures Examples
0 Comments