Risk Management – Page 9 – Cyber Security Leadership

Cyber Insurance: Managing the Risk

Cyber insurance is a hot topic of many debates today. It is believed to be the long-awaited cure for high-impact security risks, especially in light of constantly evolving privacy legislation and disclosure obligations. But what actually is it?

Simply put, cyber insurance is a tool intended to mitigate the loss from information security incidents. The decision to use it, however, should be based on rigorous risk management. Firstly, a company performs a risk assessment, during which information security risks are identified and logged. This can help the business to prioritise from a cost-benefit perspective. The company can then choose a risk treatment option: it can decide to accept, mitigate, avoid or transfer the risk.

Mitigation and acceptance are quite common approaches in the information security domain. Security professionals can implement a countermeasure to reduce the likelihood and impact of the threat. However, if it is not feasible to do so for economic reasons then the risk can be accepted. In the case of avoidance, businesses can decide not to perform the activity that exposes them to the risk. Lastly, information security risk can be transferred to a third party. This is where cyber insurance can be useful.

The ownership of risk, however, can’t be transferred fully. In the case of cyber insurance, it is more about risk sharing. Both parties should understand their accountability, liability and risk allocation.

Cyber insurance should be cost-effective. But how can one calculate the cost of such product? To understand this, we might want to look how insurance brokers work in more traditional areas. Insurance companies rely heavily on historical data, demographics and averages. The car insurance industry, for example, has evolved over many years to collate accurate statistics of the frequency of accidents per driver based on age, season, car type, country etc. in order to predict the likelihood and cost impact on a case by case basis.

For cyber insurance, however, historical data is not always readily available. Understanding the business becomes key to determining the cost. There are many parameters which can define the premium: size, territory, type of business, human errors and other unknown factors can all contribute to the price. Premiums rely on the maturity of the information security programme.

But is it possible to reduce this cost?

Yes, there are many ways to achieve cost reduction. In general, it is required for the business to demonstrate that some measures have already been taken to reduce the likelihood and impact of a potential cyber security incident. Certifications, such as ISO 27001 can be one of the ways to do so. Or for instance, having an incident response team can drive the premium down. Otherwise the insurer would have to provide its own service, hence charge the client extra. In a nutshell, premiums are never fixed. It has to be a dialogue between the company and the insurance broker. If a company adequately understands its risk, the insurance premium can and should be negotiated.

It is important to mention the importance of a holistic approach to risk treatment. Implementing controls to prevent security incidents and purchasing cyber insurance are not mutually exclusive strategies. If cost-effective, risk management and treatment should be a combination of both methods. Consider health and safety policies as an example. Safety coordinators invest in fire extinguishers minimise the impact of fire. Just like information security professionals deploy firewalls to keep malicious intruders out of the company’s network. Additionally, the building is also almost always insured. Maybe it is time to consider a similar approach to information systems.

Image courtesy of Stuart Miles / FreeDigitalPhotos.net

Poker and Security

Good poker players are known to perform well under pressure. They play their cards based on rigorous probability analysis and impact assessment. Sounds very much like the sort of skills a security professional might benefit from when managing information security risks.

What can security professionals learn from a game of cards? It turns out, quite a bit. Skilled poker players are very good at making educated guesses about opponents’ cards and predicting their next moves. Security professionals are also required to be on the forefront of emerging threats and discovered vulnerabilities to see what the attackers’ next move might be.

At the beginning of a traditional Texas hold’em poker match, players are only dealt two cards (a hand). Based on this limited information, they have to try to evaluate the odds of winning and act accordingly. Players can either decide to stay in the game – in this case they have to pay a fee which contributes to the overall pot – or give up (fold). Security professionals also usually make decisions under a high degree of uncertainty. There are many ways they can treat risk: they can mitigate it by implementing necessary controls, avoid, transfer or accept it. Costs of such decisions vary as well.

Not all cards, however, are worth playing. Similarly, not all security countermeasures should be implemented. Sometimes it is more effective to fold your cards and accept the risk rather than pay for an expensive control. When the odds are right a security professional can start a project to implement a security change to increase the security posture of a company.

When the game progresses and the first round of betting is over, the players are presented with a new piece of information. The poker term flop is used for the three additional cards that the dealer places on the table. These cards can be used to create a winning combination with each player’s hand. When the cards are revealed, the player has the opportunity to re-assess the situation and make a decision. This is exactly the way in which the changing market conditions or business requirements provide an instant to re-evaluate the business case for implementing a security countermeasure.

There is nothing wrong with terminating a security project. If a poker player had a strong hand in the beginning, but the flop shows that there is no point in continuing, it means that conditions have changed. Maybe engaging key stakeholders revealed that a certain risk is not that critical and the implementation costs might be too high. Feel free to pass. It is much better to cancel a security project rather than end up with a solution that is ineffective and costly.

However, if poker players are sure that they are right, they have to be ready to defend their hand. In terms of security, it might mean convincing the board of the importance of the countermeasure based on the rigorous cost-benefit analysis. Security professionals can still lose the game and the company might get breached, but at least they did everything in their power to proactively mitigate that.

It doesn’t matter if poker players win or lose a particular hand as long as they make sound decisions that bring desired long-term results. Even the best poker player can’t win every hand. Similarly, security professionals can’t mitigate every security risk and implement all the possible countermeasures. To stay in the game, it is important to develop and follow a security strategy that will help to protect against ever-evolving threats in a cost-effective way.

Images courtesy of Mister GC / FreeDigitalPhotos.net

Find out how security controls affect productivity in your company

To expand on my research on the human aspect of security, I created a simplified model to highlight the relationship between productivity and security. The main hypothesis, is that there is a productivity cost associated with the security controls.

The interactive simulation was created to allow users to implement their own security policies and observe the relationship between risk reduction and impact on productivity cost. Easy to understand visual feedback is available immediately for the users. This helps to understand security managers’ perspective when implementing security controls in a company.

The creation of the model was inspired by research conducted by Angela Sasse and her colleagues at the University College London.

Please get in touch if you have any feedback or would like to discuss the underlying research findings.

How to plan and deliver benefits on an information security project

Major changes frequently introduced by security projects might be seen as necessary evils without delivering value to the business. To change this perspective, a project manager should proactively manage benefits and make sure they are achievable and verifiable.

The key objectives of benefits management is to ensure that benefits are identified, defined, and linked to the company’s business strategy.

Realistic planning of benefits is the first step to achieve project success. It is, however, an ongoing activity and requires many iterations. In order to drive the realisation of benefits, the following template can be used to capture potential benefits and measure its impact on the organisation

Benefit	Expected benefit outcome	Benefit Type	Where will the benefit occur?	Who will be affected?

Image courtesy of ddpavumba / FreeDigitalPhotos.net

Teaching Information Security Concepts at KPMG

I delivered a 1,5-day Information Security Concepts course at KPMG UK.

We covered a wide range of topics, including information security risk management, access control, threat and vulnerability management, etc.

According to the feedback I received after the course, the participants were able to understand the core security concepts much better and, more importantly, apply their knowledge in practice.

Leron is very engaging and interesting to listen to
Leron has the knowledge and he’s very effective making simple delivery of a complex topic
Leron is an effective communicator and explained everything that he was instructing on in a clear and concise manner

There will be continuous collaboration with the Learning and Development team to deliver this course to all new joiners to the Information Protection and Business Resilience team at KPMG.

Productive Security

Let’s see how some security controls might affect human behaviour in a company.

Restricting software installation on computers is in line with one of the main principles of information security – the principle of least privilege. That way a security manager can make sure that employees in his company don’t install unnecessary programs which may contain vulnerabilities. Such vulnerabilities can be exploited by a potential attacker. There are instances, however, when a user may require a piece of software to perform his productive tasks. Failure to install it quickly and easily may result in unnecessary delays.
Restricting access to file sharing websites helps to make sure that a company is not in violation of the data privacy regulation and users don’t store sensitive information in the insecure locations. However, it is important for a company to provide an easy-to-use, secure alternative to enable the business.
Restricting access to CD/DVD and USB flash drives. Personal USB flash drives can be a source of malware which users can introduce to the corporate network. Restricting access to CD/DVD and USB flash drives not only helps to prevent this threat, but also limits the possibility of sensitive data leaks. It is important to understand the core business processes in a company to make a decision on restricting the access. Sometimes drawbacks of such a policy may overshadow all possible benefits.
Regular full antivirus checks help to make sure that employees’ workstations are free from malware. However, the process of scanning a computer for viruses may take up a lot of resources and slow down the machine with the possible impact on productivity,
Awareness training can be a powerful measure to protect against a wide range of security threats, including social engineering (e.g. phishing). However, research shows that blanket awareness campaigns are ineffective and a better approach is needed to address this issue.

Image courtesy of renjith krishnan/ FreeDigitalPhotos.net

Thom Langford: Security risk is just one of the many types of risks a business faces on a day-to-day basis

Interview with Thom Langford, Director of security risk management

Could we start with your personal story: your beginnings and how you got to where you are.

I was always interested in computers. My first computer was a Sinclair Spectrum 48K. I’ve always had a technology fascination. I got very much into this during school and university, and my first job was as a VAX/VMS operator, running overnight batch jobs. It was a physically tiring job, as we had to print 70,000 to 100,000 pages at night to have them delivered to the client and a 24-hour shift system, which got me to learn how to work under pressure. I then got into PCs in a big way, and moved from supporting Autodesk CAD products, to being an IT manager for a small systems integration company in Swindon. When the company was bought out by Coopers and Lybrand and subsequently merged with Price Waterhouse, to become PwC, I became known as a “builder of things”. I built a retail solutions centre, both the technology and the physical environments, from the ground up.

I subsequently built a client showcase development centre in Heathrow, a fast-track product delivery centre in London, and was also doing client work in Swansea building an innovation centre. Again, this included building both the IT as well as the physical environment: buildings, walls, the electrics and the soft furnishings, everything, basically.

I then moved to Sapient as an IT and facilities manager, which was a bit of an odd combination, although a natural move given my previous experience. I was doing that job for a number of years, initially for London and then for our global offices, when I noticed a gap in our capabilities around security, disaster-recovery and business continuity. I then spoke to one of our C level executives, and he agreed. He broadened the scope somewhat further and then asked me to start 10 days later. So it was a very rapid move for me into security. Even though I had already had a strong background in physical and IT security, this was a very different world for me. I tried to get qualified very quickly, which is something that is very difficult when you have little to no budget, which happens when you start mid-year. So I basically begged, borrowed and stole everything. We brought together a team and got a CISO on board and that’s basically where we are today. Right now I am the acting CISO. I am responsible for teams based out of India and North America, working to strengthen our security posture both internally as well as to the industry.

You are responsible for risk management. What is your view on risk management in general? How do you think is your view different from others, if at all?

I think everybody has a view on risk management, and it is not always a good one. Traditionally, risks are seen as bad and that have to be removed. They never change and the same risks are going to be there all the time. This was, at least, my perspective in the beginning. Everything is static and you live in the world of Excel spread sheets: you list your risks in them, you list what you are going to do about them, how you are going to measure them, and then you decide whether you’ve fixed them or not. Nobody was able to tell me whether a risk was acceptable or otherwise. This was basically as far as I saw, within my responsibility: to act as the conscience of a company, because that was my job. That attitude has changed for me a lot in the last 4 years. If you are the conscience of the business, the business will be stifled quite dramatically because of your security implementations. Actually, all you are doing is reducing their ability to work effectively because you don’t see the big picture of how the business operates.

Security risk is just one of the many types of risks a business faces on a day-to-day basis: socioeconomic, financial, geopolitical, legal, personnel, everything has to be taken into account. To say that a business cannot carry out an activity based on one aspect or one facet of risk, I think, is the entirely wrong thing to do. You should act more as an enabler and to become more of a yes person than a no person.

When identifying risks you will probably need the help of different stakeholders. How do you identify these different stakeholders? How do you manage the relationship with them? How do you get people to speak up?

Risk in security is just one facet of security in any business. So any enterprise should have a risk committee that is composed by a delivery group, a legal group, a financial group, etc. As long as you are measuring your risks in the same way, whether it’s in ordinal numbers or any kind of format that makes sense, those risks will be filtered as they rise up through the organisation. So if you have, for instance, 1000 security risks on your risk register, a single figure of risks should be reaching the very top of the organisation. Any more than that is an indication of people not being empowered enough to deal with risks as they emerge. Not everybody in the organisation will be able to address a risk, and so therefore, it needs to be escalated.

Escalation is not a bad thing: it’s about getting people who are better qualified or more capable or have more authority of dealing with something than you are. Not because you are incapable, but because they are in a better position than you to do so. So from the thousands that arise at the very bottom level, only a few will reach the higher levels, where they can be better dealt with.

As far as stakeholder management, it is much easier to deal with senior level stakeholder management and just seeing the very tip of the iceberg. As long as they are empowering everyone else and they can be sure that they have the tools to deal with the bulk of it all, the easier it is. This way you don’t have to deal with this vast spreadsheet concerning every single case. By empowering everybody in the organisation, it is easy for them to see why it is important to deal with risks directly. If the people at the top levels don’t want to deal with the stuff that reaches them, they basically delegate it to somebody else back down, in which case, it is being dealt with in the end.

So filtering is one approach, which is about empowering people at various levels of the organisation to recognise and deal with the risks as they feel appropriate and qualified to do so.

There are two main trains of thought in information security, namely, compliance-based and risk-based. What’s your approach, and why do you think is it more beneficial?

I think compliance is extremely useful, but it is not the be-all and end-all. Let’s say that you are using ISO 27001, for example, where measuring risk is a core part of it. But if all you are trying to do is to get the certification, you’re only engaging in security theatre. You’re only doing what is required to get the auditor happy and you are ticking things off and writing procedures, but nobody really knows anything about it. Nobody is paying any actual attention to it, apart from that one day in which you make sure that the right people are in the right office, and the auditor has that long lunch that you need, etc. So it’s a start, but it is not the way to go.

Whereas a proper risk-based approach will actually make that conversation continue way beyond the initial compliance. It’s a bit of an old argument “compliance doesn’t equal security”, which it can be if it is taken in the right sense and with the right approach. But all too often, organisations will stop at compliance and not continue with real risk-based security. An example of that is a risk register that is only looked at once a year: that is compliance. A risk register should be looked at on a regular basis to ascertain that risks haven’t changed, or if likelihoods haven’t changed, or if exploitations have changed, if risk appetites have changed within the organisation, for example. If it becomes a living and breathing document, then you are looking more at a risk-based approach to security. If it’s just a mechanical once-a-year, tick-tick-tick format, then you are in a compliance environment.

What should companies do in order for them to shift from this traditional compliance approach to the risk-based one?

I think that it is about coming back to understanding what are the benefits of security and the objectives of the business. If you can connect the benefits of your security program to the ability for a company to sell more of its products, to safely enter riskier markets (because they are able to handle their data more securely), to give confidence to their clients, to bring confidence to the industry (or to whatever regulatory body that looks after them), then that’s when you can actually get more done as a result of your security program. If you are just doing security for security’s sake, we go back to being just a conscience again.

So it’s about connecting your security programme to the goals of the business. If you haven’t even read your company’s annual report, how do you know what your security programme is supporting? If you haven’t attended a shareholder meeting or an earnings call, you can’t really know what you are doing. You only have to do this a few times to get your bearings. If you don’t understand what the core purpose of the business is, how can you actually align your security with it? It’s like IT giving out computers with Linux and Open Office when the company actually needs Windows with Microsoft Office. Linux and Open Office are perfectly acceptable approaches, but the choice for them is not aligned with the business’ needs, which probably include cross-compatibility and other functions that only Microsoft Office can do. If you don’t know what the business needs from security, you need to find out: talk, listen, read, whatever it takes to find out what it is that the business needs from you.

Let’s say that you are assigned as security manager within a company. What are the first things that you would do in your first weeks?

You need to talk: you talk as broadly and as highly as you need to understand where you are standing and what is required. Talk to as many people as possible. For instance, if you are in a manufacturing plant, you start by talking to the people on the shop floor and see how they operate. Talk to the shift leaders and the managers there. If you are consultancy, start by talking to the programme directors, to the business development people and to the partners. It doesn’t matter where you are: start talking from the ground upwards, so you actually understand what it is they do and how they do it, what they need and what they know.

These conversations might be very short, or you might run into people who don’t know much, in which case you are starting with a blank slate and you can bring your own influence onto them. If the floor leader tells you that smokers are leaving the shop doors open to go have their cigarette break, well, that’s a problem you have already identified. It’s a small issue, but potentially important. If you start solving their problems, perceived or otherwise, then you start to build fanatical advocates for security.

If you understand that the CFO’s primary goal is to ensure that he’s able to get reports and the payroll out on a monthly basis, then you can start focusing more on the integrity and availability of the data. You can then prioritize for a disaster-recovery and business continuity, so that they have the confidence that what you are actually doing is helping them do their job more easily and they are able to sleep at night. If you CFO is staying awake the night before payday because he’s not sure if his Oracle systems are going to stay up and running overnight, then that’s a problem that you can fix. So you need to communicate, talk and listen: in fact, listen twice as much as you talk, because you’ve got two ears and one mouth, and find out what peoples’ problems are, perceived or otherwise.

Password Policies: Security vs Productivity

A password policy can include a number of parameters. Let’s examine them from both security and productivity perspectives:

Minimum password length defines how many characters a password should consist of. The longer the password, the more resistant it is to a brute force attack given other password best practices are followed. Longer passwords, however, are usually harder to remember which may lead to instances of writing passwords down.
Password complexity. If a password includes a combination of upper- and lowercase characters combined with numbers and special characters, the harder it is to run a dictionary attack against such a password. Similarly to long passwords, complex passwords are usually harder to remember.
Password renewal policy ensures that users regularly change their passwords. This helps to minimise the potential security impact of compromised passwords. Although this policy is beneficial from the security perspective, users may struggle to come up with new passwords that satisfy security requirements.
The policy restricts users to set passwords they used before. This forces them to come up with new passwords to make sure that if the password was compromised it is not reused. Although this policy is beneficial from the security perspective, users may struggle to come up with new passwords that satisfy security requirements.
Locking out a user’s account after a number of wrong password attempts is a strong measure against a brute force attack. The attacker in this case is unable to try all possible combinations using specialized software. From the usability perspective, however, legitimate users might enter their passwords incorrectly as well and be unable to access the system. This may result in the increased number of calls to the company’s Help Desk or increased time for manual password reset.

Password complexity and usability explained in one comic.

Delivering a Seminar at the London Metropolitan University

I was invited to give a talk on industrial systems security at the London Metropolitan University.

The seminar was intended for academic staff to discuss current problems in this field. We managed to cover a broad range of issues regarding embedding devices and network and IT infrastructure in general.

The professors shared their perspective on this subject. This resulted in the identification of several research opportunities in this area.

Image courtesy of Vlado / FreeDigitalPhotos.net

Delivering a Seminar at the IT Security & Computer Forensics Pedagogy Workshop

I presented at the HEA STEM Workshop on human aspects of information security.

The aim of the workshop is to share, disseminate and stimulate discussions on: the pedagogy of teaching subjects related to IT security and computer forensics, and issues relating to employability and research in these areas.

During the workshop the speakers presented topics that focus on: delivery of innovative practical tutorials, workshops and case studies; course design issues; demand for skills and employment opportunities; countering the “point & click” approach linked to vendor supplied training in industry; and current research exploring antivirus deployment strategies.