Cityam 2015-05-21

AN INDEPENDENT SUPPLEMENT BY MEDIAPLANET MEDIAPLANET 7COMMERCIAL FEATUREMind the gap - thecyber security conundrumImagine that you’ve just investedin a brilliant newsecurity tool – there it sits,full of promise – but unlessyour staff know whatit should be protecting and how touse it, it’s little more than a giantpaper-weight. That’s how manycompanies are traditionally tacklingthe cyber security threat – byusing technology to fix a problem.When combating the ever growingcyber threat, it’s commonlyaccepted there is a requirement forpeople, process and technology, butall too frequently companies putmost emphasis on the latter. Whilstthis is proving a successful way toincrease budgets as leadership caneasily conceptualise the need fora solution they can touch and feel,the skills gap that subsequently occurstends to be overlooked.In KPMG Cyber Academy’s survey1 of 300 senior IT and HR professionalsin the UK 74 per cent admittedtheir new security challengesrequire skills they didn’t currentlyhave, whilst 64 per cent believedthe cyber skills needed are significantlydifferent to those used intraditional approaches. These figuresdo beg the question as to whythere is now a skills gap when thefield of information security hasbeen around for many years. Hasthe landscape changed that muchor is our dependency on technologyforcing a reliance on specificallyskilled professionals?Whilst the debate to find theanswer will, no doubt, continue forsome time, the problem remainsunresolved. So how can we beginto fill the inevitable skills gap? Threecommon areas of considerationare hiring, upskilling and outsourcing,but, as is so often the case, theanswer depends on the appetite ofthe company in question.Matt WhiteHead, KPMG access manager,matt.white@kpmg.co.ukTwitter: @cybermattwhiteSome have turned to hiring exhackersto bridge the gap and whilsta seemingly simple solution, this hasits own inherent risks with the simileof ‘poacher turned gamekeeper’springing to mind. Further complicationsarise with 57 per cent of thosesurveyed saying it had becomemore difficult to retain specialised ITstaff in recent times. So is there a betterchoice?To the cynical, upskilling is oftenseen as simply providing moretraining for IT staff so that,amongst other things, they can increasethe number of letters aftertheir name. However, if taken aspart of a structured firm wide cyberawareness initiative involving everyonefrom the C-suite to graduates,the results can be profound.Last but not least is outsourcing,an option that for years has beenimmersed in a culture of cost cuttingand efficiency benefits. However,when faced with a lack oftechnical security skillset the applicationof managed services canprovide significant returns. For example,an identity and access managementprogramme is a potentiallylabour intensive and specialistfield, but by removing the need forcontinued development or recruitmentof information security personnel,a trusted outsourced providercan deliver a level of comfortand assurance.Further benefit can be takenfrom outsourcing as it potentiallyreduces the likelihood of someoneexploiting their access rights,something 60 per cent of UK CIOssurveyed in KPMG’s ‘Trust Paradox’2 believe will come from withintheir organisation.1 KPMG in the UK’s Cyber Academy’s ‘Cyber SkillsGap Survey’ October 2014 http://www.kpmg.com/UK/en/IssuesAndInsights/ArticlesPublications/NewsReleases/Pages/Hire-a-hacker-to-solve-cyberskills-crisis-say-UK-companies.aspx2 ‘The Trust Paradox: Access Management in an insecureage’ February 2015, CIO UK in association withKPMG in the UK and RSA. http://www.kpmg.com/UK/en/IssuesAndInsights/ArticlesPublications/Documents/PDF/topics/the-trust-paradox.pdfCOMMERCIAL FEATUREThe Human Factor - Lessons learnedfrom staff training and policymanagement projectsAccording to the findingsin PWC’s “GlobalState of InformationSecurity Survey 2015,”the annual average financialloss attributed to cyber securityincidents was estimated at $2.5million, a jump of 34 per cent over2013. No one doubts that the digitalsecurity posture of an organisationis now a board level issue, and that’sa big change from five years ago. However,executive anxieties need tobe matched with a long-term structuredstrategy that everyone in thecompany ecosystem is willing to investin so that the highest standardsof information security are maintained.Inevitably, this will require achange in company culture as moststaff members view this issue as belongingto the IT department. Theyoften forget that the consumptionof IT Services is often the point ofmaximum vulnerability for thecompany. It is here that the usercan compromise the security of thecompany by becoming a victim tophishing tactics or acting in an inappropriateor negligent manner,regrettable situations that exposethe organisation to cyber risk.So what are the lessons wecan learn from implementingan appropriate strategy tochanging human behaviorin this area?Well the first is to recognise thatchanging culture in informationsecurity practices is no differentthan any other change managementprocess within a company.It is as difficult as any other changemanagement process requiringsignificant effort and resources tomake an impact.Another lesson is that qualitymatters. Too often staff securitytraining is a ticking the box exercise,with very little energy beingexpended on planning or on con-Robert O’BrienCEO, MetaCompliancewww.metacompliance.comtent. The latter is one of the most importantconsiderations in determiningthe success of a culture changeinitiative. Take eLearning contentfor example. The industry is awashwith boring, bland, and often dumbeddown IT Security training courses.It is no wonder that there are casesof low staff participation that necessitatesignificant managementintervention. ELearning coursesshould reflect the digital threat thatwe all need to combat.Another key lesson is ensuringthe correct targeting of high-riskgroups. Rather than “blanket bombing”all staff with general cybersecurity communications and policies,organisations should identifyhigh-risk staff groupings andprovide tailored messaging andsurveying. Examples of these staffgroups would be privileged users,such as administrators and informationasset owners. Clearly, thecommunications sent to these highlevel positions would be more detailedthan what would go to theoverall user population. In manycases companies are struggling toget messaging out to everyone. So ashift in priorities is required.Be prepared for the long haul. Thechanging of IT Security culture is amulti-year project. It’s not possibleto deliver all the policies and educationthat are required in a shortperiod, as the user base will becomefatigued. The best approach isto build up your communicationsover time. Obtaining outside expertiseto assist in the crafting of a fitfor-purposecommunications initiativeis one way of jump startinga moribund security staff trainingprogramme.So let’s accept that email,Share Point and corporate intranetsare not suitable for obtaining activestaff participation in proper staffawareness activities. They requiresignificant management interventionto ensure that staff membersundertake their commitments tomandatory policies and eLearning.A more appropriate approachwould be to adopt best in breed automationthat actively engages theuser and provides the necessary reportingneeded for certification andregulatory review.