{"id":37594,"date":"2020-04-11T15:31:00","date_gmt":"2020-04-11T14:31:00","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2020\/03\/02\/why-cisos-need-to-work-together-against-organised-cyberthreats\/"},"modified":"2020-04-20T08:40:20","modified_gmt":"2020-04-20T07:40:20","slug":"why-cisos-need-to-work-together-against-organised-cyberthreats","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2020\/04\/11\/why-cisos-need-to-work-together-against-organised-cyberthreats\/","title":{"rendered":"Why CISOs need to work together against organised cyberthreats"},"content":{"rendered":"\n

Mark Ferguson, CISO of Bombardier, discusses the benefits for CISOs of building a strong network of connections and communicating with security leaders to create security strategies that will stand up to increasingly organised and sophisticated cyberthreats. <\/em><\/p>\n\n\n\n

One of the defining traits of the cybersecurity sector is its\nrapid pace and ceaseless changes. Having worked in this sector for more than 15\nyears and having had the privilege to spend much of that in senior leadership\npositions, I have witnessed first-hand the way that security teams must\nconstantly strive to keep up with the evolving technology and tactics of cybercriminals.\nThreat actors have become increasingly organised in recent years, working in\ngangs, sharing tools and tactics, and even selling ready-made access to\ncompromised networks. <\/p>\n\n\n\n

I began my journey towards security leadership in 2004 when\nI was working for a controls business that was acquired by Honeywell, the\nmultinational conglomerate best known for its engineering and aerospace\nbusinesses. After earning my CISSP, I developed through several different roles\nat Honeywell including acquisitions, security architecture and risk assessment,\nbefore moving to the management side of cybersecurity within the corporate\nglobal security team. My time with the risk assessment team gave me the\nopportunity to work closely with security leaders and other executives,\nenabling me to build relationships and establish trust and credibility. I\neventually took the role of Director of Risk Assessment in 2010 and then\nprogressed to the CISO role in 2015. <\/p>\n\n\n\n

In late 2019, I eventually left Honeywell to become CISO at\nBombardier. As CISO at Bombardier, I have taken on a wider remit, looking at\nrisks beyond the scope of cybersecurity and adding  compliance and product security to the role. <\/p>\n\n\n\n

Transitioning from being CISO of one large multinational to\nanother has provided some powerful insights into the common threats that face\nall organisations today. While the two organisations share similarities, they\nhave very different business models and internal cultures, and face a similar\nyet different array of opportunities and challenges around cybersecurity as a\nresult. However, it is also notable that the two companies are being assailed\nby many of the same threats \u2013 as are most others around the world.<\/p>\n\n\n\n

Despite these shared challenges, organisations still tend to\nfight their security battles in isolation, with the particulars of threats and\ncounter strategies being closely guarded secrets. With cybercriminals becoming\nincreasingly more organised, security leaders must also begin to lower these\nbarriers and begin to work together more closely. <\/p>\n\n\n\n

Addressing the biggest cyberthreats<\/strong><\/p>\n\n\n\n

As a large high-profile organisation working in\ntransportation and aviation, Bombardier presents a number of different cybersecurity\nchallenges that I\u2019ve had to get to grips with as CISO \u2013 the person ultimately\nin charge of risk, compliance and cybersecurity for the organisation.<\/p>\n\n\n\n

Understanding the business and the\ntypes of threat actors that are interested in it, their motivations and types of\nattacks they would employ is a high priority for CISOs. Transport and\ninfrastructure are potential targets for terrorists and hostile nation states,\nand so securing that infrastructure against cyberattacks is paramount. The loss of trust that would result from failing to protect\nthe public and customers from a cyberattack would have a significant\nreputational impact. <\/p>\n\n\n\n

Securing products and data has also become even more\nimportant as companies branch into more digital offerings such as connected aircraft.\nOne of my biggest priorities is to balance the\nopportunities of new technology against the potential risks it introduces.\n<\/p>\n\n\n\n

While these kinds of unique advanced threats loom large, our\nday-to-day security operations are often generally focused on more common\nsecurity issues. A high priority for me is to reduce reliance on humans when it\ncomes to cybersecurity. Email is easily the most common vector for attack and\nwe spend a lot of time dealing with phishing, spoofing and business email\ncompromise (BEC) attacks targeting our executives, admin staff and accounts\npayable team. These attacks usually impersonate a trusted contact such as\nanother executive or a supplier, attempting to trick our employees into sharing\nsensitive data or authorising funds. When our staff\ncome to work, they need to be able to trust, open and click everything they see\nin their mailbox, so keeping email secure is essential.<\/p>\n\n\n\n

These types of attack were also one of the most prevalent\nissues in my previous roles and are a serious issue for businesses of all\nshapes and sizes. Indeed, the Internet Crime Complaint Center (IC3)<\/a> found that\nthere were over 20,000 BEC victims around the world in 2018, with total losses\nexceeding US$1.3 billion. Because attackers rarely use malicious attachments\nanymore, countering the deceptive emails used in these attacks requires\ninvestment into advanced email security tools that can spot more subtle signs\nof identity impersonation. <\/p>\n\n\n\n

In a previous role at a large international organisation, we\nwere able to deliver highest efficacy rates when we implemented Microsoft\nOffice 365 layered with Agari\u2019s email security technology to protect against\ninbound email phishing and outbound brand spoofing.<\/p>\n\n\n\n

Communicating with the board <\/strong><\/p>\n\n\n\n

A CISO needs to not only understand the cyberthreats facing\ntheir business, but effectively relate them to the board of directors.\nEstablishing a strong relationship with senior leaders is essential for\nensuring that the security team has the resources and strategic freedom\nnecessary to defend the organisation. <\/p>\n\n\n\n

One of the most important factors for success with the board\nis keeping the reporting business focused and taking a risk-based approach. The\ntechnical specifics of any security issues are largely irrelevant \u2013 instead you\nneed to concentrate on the business impact of a potential attack, whether that\nmight be financial, operational or reputational. I have found it most helpful\nto explain cybersecurity to senior leadership in terms of maturity of the\nprogramme \u2013 how mature is the programme, where are the gaps, what must we be\ndoing to close the gaps and improve maturity. <\/p>\n\n\n\n

Whenever possible, it\u2019s also good to be armed with metrics\nthat can put a potential figure on the costs involved, as this makes it easier\nto think about cyber-risks in terms of ROI. I\u2019ve found success in using a\nthree-tiered approach, split into everyday operational metrics, a tactical\nlayer for the functional leadership, and a strategic layer for the senior\nleadership and the board. <\/p>\n\n\n\n

Building a strong cyber culture <\/strong><\/p>\n\n\n\n

Alongside securing buy-in from the top, a CISO also plays an\nimportant role in shaping their organisation\u2019s cybersecurity culture. Cybercriminals\nsee the human element as the chink in the armour and common strategies such as\ndeceptive emails are designed to exploit this perceived weakness. Even one\nemployee falling for a phishing email can facilitate a major breach, so the\nentire workforce needs to be aware about the importance of good cyber\nbehaviours.<\/p>\n\n\n\n

While it is both unfair and unwise to place the burden of\nspotting phishing emails and other threats on the shoulders of employees,\nfostering a high level of awareness can make all the difference. All staff\nshould be aware of common signs of malicious emails and other suspicious\nactivity and have a clear idea of how to report concerns to their management or\nIT and security teams. <\/p>\n\n\n\n

I have had tremendous success in using an ambassador\nprogramme to help provide this awareness and develop a strong security culture.\nEmployees who have the right interest and aptitude in security were brought on\nboard and trained to teach the benefits on our behalf. I have found that people\ngenerally respond better to security advice when it comes from a peer or fellow\nemployee in their department, rather than being handed down by the corporate\nsecurity team. <\/p>\n\n\n\n

The need for a unified approach <\/strong><\/p>\n\n\n\n

Being a CISO is a high-pressure role that requires providing\nleadership for a wide variety of areas around risk and cybersecurity,\ntechnology in general, as well as other concerns including legal, privacy and\nproduct issues. While this hectic schedule often leaves little time for looking\noutside of the company walls, I believe it is increasingly important for CISOs\nto take the opportunity to communicate with their counterparts at other\norganisations and begin to work together.<\/p>\n\n\n\n

Cybercriminals have become increasingly well organised, with\neven a lone-wolf opportunist being able to easily purchase tools and\ninformation from others on the Dark Web. We have also seen a greater threat\nfrom organised groups that function in a similar manner to a legitimate\nbusiness. Using the same kinds of tools as real marketing and sales teams, they\ncan collate data for thousands of potential targets and send out huge automated\nphishing attacks. In most cases, these attacks are completely industry\nagnostic, or else will be targeting many companies within the same sector. <\/p>\n\n\n\n

Meeting other security leaders and sharing information about\nthese attacks, as well as other cyberthreats such as new malware tools, can\nprovide extremely useful intelligence that may make the difference in thwarting\nan attack. <\/p>\n\n\n\n

Attending security events, open forums or closed-door ones, has\nbeen one of the most useful approaches I have encountered for forging these\nconnections and sharing intelligence. Many industries such as aviation and\nbanking have their own sector-specific events which can be useful for\ndiscussing more targeted threats such as security issues around connected\nproducts. <\/p>\n\n\n\n

At the same time, invaluable intelligence can be gleaned\nfrom CISOs from other industries. As discussed, some of the most pressing\nthreats we face transcend sector and meeting other security leaders can be a\nreal eye-opener. The annual Agari Trust conference is one example of an\neffective sector agnostic meetup I attend annually with representatives from a\nhuge variety of businesses.<\/p>\n\n\n\n

Events that provide the opportunity for security leaders to\nmeet behind closed doors are particularly valuable. While speeches and\ndemonstrations are extremely useful, CISOs will be able to discuss their\nsecurity challenges more freely in private. <\/p>\n\n\n\n

By building a strong network of connections and regularly\ncommunicating with security leaders in other sectors and geographical\nlocations, CISOs can further improve their ability to create security\nstrategies that will stand up to increasingly organised and sophisticated cyberthreats.\n<\/p>\n","protected":false},"excerpt":{"rendered":"

Mark Ferguson, CISO of Bombardier, discusses the benefits for CISOs of building a strong network of connections and communicating with security leaders to create security strategies that will stand up to increasingly organised and sophisticated cyberthreats. One of the defining traits of the cybersecurity sector is its rapid pace and ceaseless changes. Having worked in […]<\/p>\n","protected":false},"author":21,"featured_media":37597,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[205,51,57,93,2122,24],"tags":[8923,3877,564,6576],"class_list":["post-37594","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-case-study-newsletter","category-enterprise-security","category-top-stories","category-transport","category-used","tag-bombardier","tag-cisos","tag-cybersecurity","tag-cyberthreats"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=37594"}],"version-history":[{"count":6,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37594\/revisions"}],"predecessor-version":[{"id":38327,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/37594\/revisions\/38327"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/37597"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=37594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=37594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=37594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}