{"id":31942,"date":"2019-07-25T08:11:40","date_gmt":"2019-07-25T07:11:40","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/?p=31942"},"modified":"2019-07-29T11:20:06","modified_gmt":"2019-07-29T10:20:06","slug":"maintaining-the-integrity-of-the-national-lottery","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/07\/25\/maintaining-the-integrity-of-the-national-lottery\/","title":{"rendered":"Camelot CISO on maintaining the integrity of The National Lottery"},"content":{"rendered":"

Camelot is the licensed operator of the UK\u2019s National Lottery. David Boda \u2013 Group Head of Information Security \u2013 Camelot, tells us how he approaches cybersecurity challenges to ensure the organisation stays cybersecure and maintains its integrity.<\/em><\/p>\n

\"\"
David Boda \u2013 Group Head of Information Security \u2013 Camelot<\/strong><\/figcaption><\/figure>\n

Camelot has been the licensed operator of The National Lottery since its launch in 1994. The company is made up of around 750 employees.<\/p>\n

David Boda has been Group Head of Information Security for more than three years and is tasked with overseeing all aspects of information security.<\/p>\n

He says of the role: \u201cWe run our own Security Operations Centre (SOC) so it\u2019s quite a nice environment to work in because we do most things in-house.<\/p>\n

\u201cBecause the lottery is heavily dependent on integrity there\u2019s a lot of buy-in from the business for what we are trying to achieve, as well as from the wider stakeholder community.<\/p>\n

\u201cThe National Lottery celebrates its 25th this year and we\u2019ve just passed the \u00a340bn mark of money that has gone to charities and good causes as a result of what we do. That\u2019s also one of the reasons I like working here \u2013 it\u2019s not just about being a commercial organisation, it\u2019s about giving back.\u201d<\/p>\n

Cybersecurity challenges <\/strong><\/p>\n

At Camelot, all aspects of security are relevant but there is a strong focus on integrity.<\/p>\n

\u201cPeople need to have confidence that if they play a game, they know they\u2019ve got a fair chance of winning,\u201d Boda said.<\/p>\n

\u201cWe spend a lot of time trying to threat model that out and understand how we can come up with the right answers to give all of our stakeholders the assurance they need \u2013 whether it\u2019s regulators, the public playing the games or other stakeholders.<\/p>\n

\u201cAround 60% of UK adults currently play National Lottery games. So that\u2019s a large proportion of the UK adult population coming into contact with one of our products at some point, whether it\u2019s a Scratchcard, online IWG or a EuroMillions or Lotto ticket.\u201d<\/p>\n

The day to day job<\/strong><\/p>\n

Boda makes a point of checking his emails just once a day, preferring face to face interaction with his team and the wider business stakeholders.<\/p>\n

This, he says, is a better way of finding out what the real challenges are, instead of attempting to filter through emails.<\/p>\n

\u201cI try to balance it to make sure I\u2019m in the office enough but obviously there is quite a lot of external engagement with suppliers, partners and peers in the industry,\u201d he said.<\/p>\n

Threat sharing and collaboration<\/strong><\/p>\n

\u201cI place quite a big emphasis on the value of threat intelligence sharing so we do a lot of work in that space as well.  The attackers do it and from a defence point of view it makes sense,\u201d he said.<\/p>\n

\u201cSo if you are mindful of any commercial sensitivities \u2013 there are plenty of ways to collaborate and help each other out without tripping up \u2013 then it\u2019s really important.\u201d<\/p>\n

Boda is Chairman of the Cybersecurity Working Group within the World Lottery Association, which is set up around the idea of threat intelligence sharing.<\/p>\n

Alongside the National Cyber Security Centre (NCSC), he\u2019s also part of a gambling and gaming sector trust group which is also about threat sharing \u2013 something he set up with his former counterpart at William Hill.<\/p>\n

\u201cSometimes it\u2019s not just about an IP address you\u2019ve seen or a change in DDoS attacks, it could be that we\u2019re thinking about using a new vendor and you want to have a conversation about \u2018well, if you\u2019ve used that vendor already what was your experience with them?\u2019\u201d<\/p>\n

The vendor \u2013 end user relationship <\/strong><\/p>\n

\u201cSometimes I think there\u2019s a bit of tension there, on both sides,\u201d Boda concedes. \u201cI think it\u2019s a lot about making sure vendors and CISOs and end users make a conscious effort to take time to understand each other\u2019s perspectives and build relationships with each other. It\u2019s about long-term partnerships, it\u2019s not about transactional things and, through that understanding and relationship building, then the whole buy-sell becomes a lot easier.\u201d<\/p>\n

On selecting vendors <\/strong><\/p>\n

There are many vendors offering a multitude of products and solutions. For Boda and his team, the selection process is driven predominantly by the organisation\u2019s three-year information security strategy.<\/p>\n

If approached by a vendor, Boda says he is open and transparent about their offering not being part of the organisation\u2019s roadmap at that time, but the solutions are given due consideration in a thorough testing phase when the time is right.<\/p>\n

\u201cIf we\u2019re doing a security thing, it means we\u2019re not spending on a commercial thing or something else, so it\u2019s really important that, when we pass that business case across the table, we can look the CFO, CIO and other stakeholders in the eye and say we genuinely believe that it\u2019s in the best interest of Camelot to be doing that.\u201d<\/p>\n

The skills shortage<\/strong><\/p>\n

Boda believes the private sector has a role to play in helping to combat the ongoing cyberskills shortage, alongside government initiatives.<\/p>\n

\u201cI think you recruit a team, you don\u2019t recruit individuals, so you have to have a balance of people that do have experience, but you should also be taking people and training them up,\u201d he said.<\/p>\n

Camelot also has an internal red team which is used for running simulated attacks against the organisation itself.<\/p>\n

\u201cIf the only time you see bad stuff happening is when bad stuff is actually happening, then you\u2019re probably not going to react to it very well but if you\u2019re constantly practising that then your judgement calls are going to be better, so we use that red team capability as a core part of our learning and development as a team,\u201d he said.<\/p>\n

The importance of ongoing training<\/strong><\/p>\n

A key part of Camelot\u2019s overall strategy is around building a strong security culture. It\u2019s not just about \u2018putting posters up in the canteen\u2019 \u2013 it\u2019s about understanding how to create a behavioural change.<\/p>\n

One recent example involved inviting a comedian to speak during a lunch session. His sketch is based around his experience of having his identity stolen when he was younger.<\/p>\n

\u201cIt\u2019s not ramming security down people\u2019s throats, but for that hour they\u2019re thinking about security and, at the end of it, I talked about how his experience related practically and what it means for Camelot,\u201d Boda said.<\/p>\n

\u201cIf, hypothetically speaking, The National Lottery contact centre wasn\u2019t carrying out data protection checks properly or if we were socially engineered into giving out information, that means personal information could be compromised.<\/p>\n

\u201cWe really landed those key messages in a much more effective and memorable way.\u201d<\/p>\n

On what makes a good CISO<\/strong><\/p>\n

\u201cSomeone who has got a good broad range of skillsets, from the commercial business side of things to being able to talk credibly, technically,\u201d Boda states.<\/p>\n

\u201cIt doesn\u2019t mean they need to have a comprehensive understanding of every detail but they need to be able to ask the right, probing questions, draw out the issues and be able to communicate those effectively.<\/p>\n

\u201cSome CISOs are much better at being able to communicate with the board and bounce ideas around how they\u2019ve done that, or being really good at presenting metrics. Some are great at challenging their team or vendors and really asking the probing questions.<\/p>\n

\u201cWe\u2019ve all got our strengths and weaknesses, and being able to help each other out is really valuable.\u201d<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Camelot is the licensed operator of the UK\u2019s National Lottery. David Boda \u2013 Group Head of Information Security \u2013 Camelot, tells us how he approaches cybersecurity challenges to ensure the organisation stays cybersecure and maintains its integrity. Camelot has been the licensed operator of The National Lottery since its launch in 1994. The company is […]<\/p>\n","protected":false},"author":28,"featured_media":32063,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[205,51,57,1489,93,24],"tags":[9002,8429,12871,12872,12873,8837,12874,12875,5006],"class_list":["post-31942","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-case-study-newsletter","category-enterprise-security","category-insights","category-top-stories","category-used","tag-chairman","tag-cyberskills","tag-david-boda-group-head-of-information-security-camelot","tag-euromillions","tag-intelligence-sharing","tag-national-cyber-security-centre","tag-scratchcard","tag-the-national-lottery","tag-uk"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=31942"}],"version-history":[{"count":16,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31942\/revisions"}],"predecessor-version":[{"id":32357,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/31942\/revisions\/32357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/32063"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=31942"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=31942"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=31942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}