{"id":31403,"date":"2019-07-01T10:46:06","date_gmt":"2019-07-01T09:46:06","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=31403"},"modified":"2019-07-01T10:46:06","modified_gmt":"2019-07-01T09:46:06","slug":"expert-informs-business-leaders-on-how-to-maintain-a-positive-approach-to-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/07\/01\/expert-informs-business-leaders-on-how-to-maintain-a-positive-approach-to-cybersecurity\/","title":{"rendered":"Expert informs business leaders on how to maintain a positive approach to cybersecurity"},"content":{"rendered":"

The evolving cyberthreat landscape is forcing C-level executives to improve or adapt their defence strategies. Chester Wisniewski, Principal Research Scientist in the Office of the CTO, Sophos, tells us why a proactive approach can contribute to building a positive security culture and defend against attacks. <\/em><\/p>\n

How can smart technologies like AI and ML contribute to monitoring or preventing cybersecurity attacks?<\/strong><\/p>\n

I think we\u2019re in the really early stages of seeing the benefits from this and the initial thing everybody\u2019s done, including us, is think about how we use it to enhance the protection we\u2019re providing at different places in the attack chain.<\/p>\n

But I think where the real value is going to lie in the long term will be focused on augmenting the humans so that we become more efficient at what we do. The challenge for humans is managing the ridiculous quantities of data we have coming in \u2013 humans simply cannot deal with it. This is where Machine Learning and AI come in.<\/p>\n

Humans are really good at taking a quick look at something and immediately recognising whether it\u2019s good or bad and machines are terrible at it. When you look at how you measure the effectiveness today of a Machine Learning algorithm blocking for anti-malware, it\u2019s measured on what\u2019s called a rock curve. That means that you\u2019re measuring it because you have to decide on how aggressive you want to be because if you move too far one way, you find all kinds of false positives and detect all the bad stuff and if you move too far the other way, you\u2019re getting very poor detection but you\u2019re never wrong. The challenge lies in how much \u2018wrong\u2019 you\u2019re willing to accept to get higher detection.<\/p>\n

How can businesses improve their defences against users being tricked into inviting malicious attackers into their network?<\/strong><\/p>\n

You need to structure things so that they\u2019re more personal – use real examples of phishes that were sent to your executives in the screenshot in your presentation that you do for your staff. Have someone in one of your departments stand up and tell a story of what happened to them \u2013 make it personal if possible. Another approach, which can often be a better solution, is to change a business process rather than trying to do it with technology. A lot of businesses are doing this and trying to avoid business email compromises, people are being tricked to change the wire transfer because they impersonated the CFO or the Head of Finance. Look at your business processes and see if there\u2019s a way you can train a small number of people on a very specific thing that helps protect them rather than trying to do a generic thing for 400 people that only applies to a small number of them. At Sophos for example, our Human Resources department is responsible for opening up documents all day of people\u2019s CVs. Nobody else is responsible for that so if we can focus training just for the four of them and make it more personal to their way of working by showing them a slightly harder way of doing it, that\u2019s going to provide security and safety. I don\u2019t want to train 500 employees on it \u2013 they\u2019re not going to pay attention to it, or if it\u2019s hard it\u2019s going to slow them down. I only really care about the four employees in HR because they\u2019re the ones that are high-risk. I can afford to give them personal training, rather than some kind of broadcast medium.<\/p>\n

How can employees contribute to creating a positive culture around data security? <\/strong><\/p>\n

I think it\u2019s really important that it\u2019s positive. An incentive might be to do a drawing for a gift card for \u00a3100 to a nice local restaurant once a month and tell them that if they report anything they think might be a phish to a security team, we promise we\u2019ll get back to you in half an hour and anybody that reports something, we\u2019ll put your name in the phish bowl and we\u2019ll draw a card once a month \u2013 it\u2019s the best \u00a350 or \u00a3100 they\u2019ll spend. It\u2019s saying, please help us – we can\u2019t do security without you and to show you we really mean it, we\u2019re giving you a gift in return. Make it really well-known how to do it.<\/p>\n

How can business leaders improve their approach to ensure this happens?<\/strong><\/p>\n

I think it has to be throughout the organisation \u2013 it can\u2019t be initiated by the CIO or CISO, it has to be something that\u2019s embraced by all the upper management. Everyone must understand that security isn\u2019t an IT problem, data security is a business problem. IT can\u2019t control what finance does, finance have their own processes, they have to embrace it and it has to be a part of their culture as much as it is IT\u2019s. It may be IT\u2019s job or the CIO group\u2019s job to stop that framework for that positive message or easy processes, but then the leaders of all those groups within the company need to embrace that with their staff and let them know that this is a team thing no different than the physical security of our building, which is obviously a joint responsibility also. Keeping it positive can be tough but any time there is a punitive thing, think about turning it on its head. For example, if you\u2019re doing phishing tests, instead of just reporting that 20% of people failed, also measure how many people reported it to the security team and start measuring that as a positive metric that you want to see increase.<\/p>\n

Generally, in IT, we always focus on the negatives and we\u2019ve got to look at it the other way around \u2013 how much did we block, how many people did we protect, how many people reported \u2013 so that people feel good about participating.<\/p>\n

How important is it for business leaders to build and maintain reliable employer relationships to avoid insider threats? <\/strong><\/p>\n

Insiders are tough. If you have an insider attack it\u2019s likely to be a problem that\u2019s going to increase. It\u2019s very difficult to defend against this kind of thing and if I consider it from our own company perspective \u2013 we have a lot of loyalty because we treat our people with a lot of respect and while we expect a lot from them, we give a lot back. I think that creates a very positive environment which makes it more difficult to be that malicious insider. If I were to turn tomorrow, I would be so isolated because the people I work with are so loyal, they\u2019d expose me. It would be hard to get away with it because the team I\u2019m on is so invested in the company.<\/p>\n","protected":false},"excerpt":{"rendered":"

The evolving cyberthreat landscape is forcing C-level executives to improve or adapt their defence strategies. Chester Wisniewski, Principal Research Scientist in the Office of the CTO, Sophos, tells us why a proactive approach can contribute to building a positive security culture and defend against attacks. How can smart technologies like AI and ML contribute to […]<\/p>\n","protected":false},"author":21,"featured_media":31404,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,1489,93],"tags":[564],"class_list":["post-31403","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-top-stories","tag-cybersecurity"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=31403"}],"version-history":[{"count":1,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31403\/revisions"}],"predecessor-version":[{"id":31405,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31403\/revisions\/31405"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/31404"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=31403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=31403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=31403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}