It’s a new year and corporate concerns about cybersecurity risk are high. Which means top executives at Fortune 500 companies will do what they always do — spend big on security technology. Global cybersecurity spending is on a path to exceed $1 trillion cumulatively over the five-year period from 2017 to 2021, according to Cybersecurity Ventures.
But increasing budgets each year with little strategic forethought is a corporate failing. Further, the lack of proactive monitoring of cyber risk profile almost ensures gaps and vulnerabilities that will be exploited by hackers.
Corporations that don’t formulate a thorough cybersecurity plan and monitor its implementation will encounter more breaches and increasingly become mired in scuttled M&A opportunities. Market research firm Gartner says that 60% of organizations engaging in M&A activity are already weighing a target’s cybersecurity track record, posture and strategy as a key factor in their due diligence. A company that has been hacked is a less attractive acquisition target — hardly a minor point, given that M&A activity globally, led by the U.S., has set records in recent years and is widely expected to maintain or exceed this level going forward.
The most highly publicized example of an M&A-related cybersecurity headache was Verizon’s discovery of a prior data breach at Yahoo a couple of years ago, after formulating an acquisition agreement. The discovery almost killed the deal and ultimately resulted in a $350 million reduction in Verizon’s purchase price.
Enterprises must step up to the plate once and for all and develop meaningful metrics to assess the quality of their cybersecurity protection and monitor its completeness and effectiveness. And the best way to do this is to begin taking steps to incorporate continuous controls monitoring (CCM).
The ultimate goal of CCM is to ensure real-time visibility into the cybersecurity posture of the enterprise while identifying coverage gaps for priority remediation and introducing a level of accountability into the effectiveness of the spectrum of products and tools that are likely installed within an enterprise’s security operations. At the end of the day, it’s about monitoring and measuring effectiveness and providing a framework for determining ROI from cybersecurity investments.
Adopters of CCM, which provides a thorough snapshot of an enterprise’s cybersecurity posture in real time, must first begin scoping their cybersecurity ecosystem. Understanding all the nooks and crannies inside their enterprise and outside with third-party vendors is critical. It’s best to start with easy CCM controls as a pilot, providing the opportunity to work out kinks without big headaches and to help build the confidence of the technical team involved. Analytics, of course, also have to be run on the collected data.
Early versions of CCM, recently introduced into the market, enable companies to stop playing whack-a-mole when trying to discern which one or two of scores of security threats are truly legitimate, then swiftly respond. CCM helps reduce business losses by using effective continuous auditing mechanisms and control monitoring of various aspects of cybersecurity procedures — courtesy of a dashboard providing a holistic view of a company’s cybersecurity posture.
The concept of continuous monitoring in an enterprise isn’t new — it has been used successfully in financial auditing for years — and tool vendors such as Panaseer, Prevailion, vArmour and Code Dx have begun introducing the required goods. The federal Office of Management and Budget has already been ramping up for the implementation of CCM for a year, and Goldman Sachs is also an early adopter.
For CCM adopters, scoping their cybersecurity ecosystem is simply the start of a multi-step process. The implementation of CCM actually entails five additional steps. They are:
Take time to thoroughly understand your IT footprint. In particular, analyze how CCM will be incorporated into your company’s entire IT and compliance strategy and how it may change over the next five years. This helps to determine which CCM system is best for you.
Gauge your security needs with the help of risk analysis and then prioritize them. Also take the measure of your in-house cybersecurity talent. Decide who can help implement and work with CCM and whether your budget may need to be increased to accommodate outside experts and unknown contingencies.
When you do your pilot testing, make a point of gauging each test before wrapping it into the total CCM solution. Otherwise, this could lead to a larger number of falsely reported cyberattacks. This may also enable better tailoring of your CCM solutions to the specific needs of your organization.
Establish an escalation protocol. If a legitimate red flag arises, this would trigger additional investigation to determine whether a wider problem exists. The protocol should include the notification of specific individuals and departments and, depending on the circumstances, an automatic call for outside help.
Make documentation a priority. If a red flag does spark an investigation, it’s important to carefully document every step that is taken and store this information so it can be easily and quickly retrievable if a regulator wants to review them.
There is one more key step involved in the proper implementation of CCM. After all of this is accomplished and CCM is implemented in your organization, work obviously has to be subsequently done to gauge the value and resilience of the CCM technology.
After a year, for example, companies will know how many cyberattacks were stopped before they became outright breaches and how quickly they were stopped. Then, to the extent possible, they have to compare this data with similar cybersecurity data in past years. Improvement in the number of cyberattacks caught early may be the best single indicator of success.
The ultimate goal of CCM is to stop cyber breaches in the first place, but CCM alone will not accomplish this mission. CISOs and other top cyber executives must also convince top executives that they must learn to trust them. The CEO and the board of directors need to realize that cybersecurity is not a priority only when an intrusion occurs.
If there is any debate about this, it will end soon with the pending implementation of new 5G networks, which could easily become the single most challenging issue in the cybersecurity world. 5G will introduce a new era in which billions of additional devices will be connected to the internet every year, each running crucial applications and infrastructure at hundreds the times the speed of the current internet.
Wireless infrastructure will explode, capitalizing on brand-new infrastructure to connect geographies and substantially improve smart city infrastructures, among other things. But 5G will also materially darken the threat landscape. In fact, potential physical damage at a 5G pace is almost unthinkable.
No question, we’ll be needing a better cybersecurity playbook, one replete with CCM technology. It’s time for enterprises to strategize seriously and realize they must move from firefighting to fireproofing.