B2BiQ features personal conversations about the business disciplines of Process Excellence, Shared Services, Customer Experience and Customer Management.
B2BiQ features personal conversations about the business disciplines of Process Excellence, Shared Services, Customer Experience and Customer Management.
Tom Kartanowicz, Financial Services Cyber Security
Tom Kartanowicz joins us and shares his thoughts on CISO Reporting, Prioritization and the evolution of the CISO journey.
Christine Vanderpool, Florida Crystals
Christine Vanderpool is an Executive Board Member for Cyber Security Hub. She was Inteligenca’s 2019 Woman Cyber Security Leader of the Year and Molson Coors’ CISO before being whisked away to the world’s larges sugar cane refiner- Florida Crystals (which includes Domino Foods).
So Christine is certainly an excellent current example of a CISO. Her company is an industry leader, she’s the ultimate cyber security leader at her organization and she’s winning awards for her work. But her background doesn’t add up to what we once understood as a good example of a cyber security leader. She doesn’t have any military experience and “well, I'm definitely an extrovert.”
Business case It’s safe to say that the ‘old guard’ of cyber security leaders is not a group of extroverts. “I love to use analogies and storytelling. It's really important for me that my user community, my executives, my leadership, they understand what it is that I'm trying to do. They don't just blindly believe me because I'm scared the bejesus out of them, but they actually get what I'm trying to tell them. They understand what our risks are. They understand how I want to mitigate those risks. And I try to do it in ways that are appropriate for our business at hand.”
Budgets In describing her mission, Christine doesn’t use the word technology. And it’s not because she’s some marketing person- her formative years were spent with IBM, Hitachi and SAP technology- she’s a technology person. But she realizes that just talking tech won’t get the job done. As noted, her job is for her stakeholders to understand what she is doing.
The Cyber Security Hub Mid Year Report showcased the fact that budgets are mostly flat or down. If Christine was arguing for budget, tech first- she would not find success. Her executives and leadership understand the risks and how to mitigate those risks in a way that’s appropriate for the business because she’s made the business case.
Enabling business “I'm not going to buy the latest and greatest gadget just cause it's really cool, if we don't need it. My philosophy is you could take that same budgetary funding and use that on a say marketing project or a product development project that is going to increase your revenue. If your revenues increase, then my bonus increases. So I'm not stupid.”
She says she’s not stupid- which of course, is obvious. But that statement actually shines a spotlight on her brilliance. She’s going in to budget meetings and telling her leadership to spend money on product development and marketing based on the confidence she has in the business case she’s made. She is not worried about losing her needed budget.
Doctrine In Depth And there’s depth to that doctrine. She does things “that elevate and help the business is rather than just saying no.”
As the interview with Bob Turner informed us, she’s leading the Department of Know, not the Department of No.
When asked if she’s a BISO- a Business Information Security Officer with a CISO title, she responds, “I wouldn't have a job if, if we weren't doing what it is that we do as a company. I work for a consumer packaged goods organization. So I need to always remember that that is the purpose of why we are here. We are not here because of security. We are here because we make a product that is sold to consumers. And that should be the focus.”
Bob Turner, University of Wisconsin
Bob Turner- a friend and Board member of the Cyber Security Hub- as well as the University of Wisconsin-Madison CISO - was kind enough to make some time for an interview. The following is an overview of the past, the present and perceptions of the future cyber security reality.
The University of Wisconsin is a research one level university with about 23,000 staff, roughly 44,000 students during the normal part of an old-normal year. This number jumps to a total of 80,000 users overall, when considers affiliates and ancillary personnel which means roughly a hundred thousand end points. Thus Bob notes that the University has a large amount of important research.
His resources are focused- he's got 38 full time staff with about 20 students that are supporting governance, risk management, incident response, vulnerability and what they call the common system Cyber Security team- which focuses on the big ERP-type systems, HR, Finance and Student Information.
During the March, 2020 migration off-prem- Bob's team was responsible for protecting that research, rolling out the BCP and moving 3,700 classroom courses to online delivery- to name a few initiatives.
The BCP did in fact roll out well- Bob was happy with the team and confident in the execution, “the X factor, I think, was trying to understand how many of the different collaboration tools were out there and understanding about those tools that we may not have looked at very close in the past. We had to do that on the fly and we had to do it rapidly.”
The Past: Shop in order It was confirmed for Bob and his team that ‘the past’ was secure. There were not issues in rolling out the business continuity plan, which was secure. There were not issues with the systems in place, which were secure.
The team continued with business-as-usual, “daily security routines run a playbook and a SOC and the regular pattern and pace of risk assessments and policy management, as well as trying to ensure that our users are aware of issues.”
The Present: Work to be done Now 100% remote, with business-as-usual going smoothly, on a dime- ‘the present’ presented a threat matrix, which could not have been anticipated based on the fact that a 100% remote global workforce was not anticipated by anyone.
And so Bob and the team “had to put together a provisional policy on how to manage collaboration tools: What do you record? How do you record it? What type of data can you talk about over the air? Do the solutions have encryption in transit and encryption at rest, and is that encryption a suitable standard?”
As Bob tells it, beyond collaboration tools, “COVID brought with it a whole bunch of fun, little scams, a lot, a dramatic increase in the phishing attacks, business, email, compromise attacks and anything social engineering happening in real time.”
With digital machete in hand, Bob slashed through all of those new issues to ensure that he and his team could take a step back and have a big picture focus on what he’s always focused- people, process and technology.
The Future: The Department of Know With a big picture focus on people, process and technology- technology could be construed as your tools and process could be construed as your tactics. Tools and tactics can be improved or replaced to fit better with a new reality. But changing people is a more delicate and more gradual shift.
“If it's face to flat screen, not face to face, we need to be able to see the person on the other end and understand if they're stressed or if they're, calm and cool and collected. It's about listening very carefully to those indicators. We have staff who are spending part time as parents which means part time as a teachers and part time as the custodial staff in the house. And, and then they're also working for us.”
“So the eight-hour workday is not contiguous. We have to make
Suresh Chowdary, Nokia
During this digital summit panel, Suresh Chawdhary, head of security & privacy for Nokia, stresses the importance of a layered, multi-pronged cyber security approach to best protect from phishing and whaling. This layer defense mechanism moves away from a one-size-fits-all strategy, ensuring that everyone across the enterprise is well equipped to stay protected against threats.
Three Cyber Security Defense Layers To Consider By baseline testing employees for their susceptibility to phishing, an enterprise gathers statistics and builds an actionable and measurable improvement plan. Even within this layer, different departments are responsible for different deliverables. That means that malware threats and other vulnerabilities will affect separate industries and divisions within that industry to varying degrees. By customizing phishing tests—much like bad actors do—a holistic and accurate pattern emerges. A second layer is to have targeted training sessions for employees so that they understand what is anticipated and expected from them, how to report phishing attempts properly, and how to make sure that they are not processing payments or sending these kinds of sensitive personal information on emails when they get these kinds of emails. A third approach is targets key executives. Suresh warns that this can get tricky. Leadership team members are often global, meaning they’re traveling frequently to meet customers and vendors or participate in seminars and conferences. They also have a multiset of technologies at their disposal. With all these touchpoints, it is difficult for a CSO or an information security organization to inform executives of the varying degrees and types of risks. In this case, Suresh suggests relying on proactive, reactive, and detective controls to safeguard them. Because awareness alone doesn’t cut it for these busy individuals, multifactor authentication mechanisms and email encryption are a must. For example, a two-factor mechanism for approving invoices through email mitigates risk considerably. Things To Consider When Developing A Cyber Security Plan Finance and HR employees are particularly vulnerable due to their payment processing duties. An email spoofing the head of finance or the CEO may expertly convince an employee to urgently transfer money at the click of a button. The possibility of getting that money back is nearly zero. Additionally, HR has a massive amount of sensitive data at their fingertips. Data is the new oil in the cyber crime industry. All it takes is one slip or a single lapse in judgment for a breach to expose personal data so sensitive—such as credit card and social security numbers—that it creates a lawsuit or enough bad press to devastate an organization.
Examining the big picture and important factors of an organization helps build a plan that fits the company in terms of cost, risk profiles, and the size of the organization. Considerations may include:
Cloud service encryption packages Appropriate number of training sessions per year Regulations and limitations of certain technologies across different geographies A security plan isn’t going to be the same across an organization. Still, there are certain baseline technologies that build the foundation of security—namely an antivirus solution and a personal firewall for every employee across the globe. While email encryption is a nice-to-have for all employees, it is a must-have for people who are prone to whaling attacks, including the C-suite and leadership team. Other departments to keep in mind for customized control mechanisms are finance, HR, legal procurement, and suppliers. It is important to have a combination of proactive and reactive controls when dealing with these hidden enemies.
Advanced Persistent Threats The obvious goal to a phishing or whaling attempt is an immediate financial ga
Jim Brady, Fairview Health Services
During this digital panel session, Jim Brady discusses real-time change in incident management. His extensive experience in a multitude of security roles throughout his career means he has seen a lot of changes in the healthcare cyber security field. Naturally, the latest change to make its mark is the new remote work environment COVID-19 has deemed nececessary.
A New Reality in Cyber Security In the past, incident response plans are created and workshopped on location—in the case of healthcare, at the hospitals, command centers, etc. Now, with most of IT, the administration staff, and even doctors working remotely, new considerations must be taken.
Now that vendors, legal counsel, and staff are working from home, are they vulnerable to new threat actors, or are the bad guys giving healthcare a break during this global pandemic? Unfortunately, opportunistic phishing scams are increasing as the world is combatting COVID-19. For example, some phishing attempts run under the guise of PPE equipment vendors.
Additionally, while telehealth works as a good alternative to in-person doctor appointments, is it secure?
Three Main Threats A well, executed cyber security incident has the possibility to severely disable or even take down organizations. In the healthcare field—especially during this time—it is imperative that hospital doors remain open. CSOs are especially on alert for the following three threats:
Data breaches Ransomware and wiperware Medical device and IoT tampering There are a few key things CSOs can do to effectively mitigate these areas of vulnerability. The first challenge is managing the environment remotely now that key security staff is working from home. System access needs to be the same as it was onsite. Home networks require an appropriate amount of bandwidth and the right VPN access must be granted. Home workers need the proper security for their home router firewall.
Incident Response Plans A holistic cyber security plan not only works to prevent incidents but respond to them as well. In the way that fire departments educate on fire prevention while also maintaining the ability to put fires out, responding quickly to a breach is imperative. For example:
Knowing who to go to if a critical IT system needs to be shut down Knowing who the decision-makers are and having their contact information up to date and accessible Creating a communication plan across departments that includes at-home employees’ contact hours and preferred forms of communication. Keeping contact methods such as video chats on secure platforms
Architecting a command center is difficult enough on prem with a team. It has only gotten harder with everyone spread out remotely. A communication grid helps clarify who communicates what to who. The C-suite needs regular high levels of communication. Clinicians on the front lines delivering care need access to the technologies that are required to do their jobs. Educating the administration staff on how to stay safe at home is also imperative. These non-technical positions are more prone to insecure home network and firewall setups. BOYB devices must not be used by family members or left insecure. All of these things need to be considered when developing an incident response plan during this pandemic.
Staying Physically Safe While Keeping The Network Secure The health and safety of employees is also tied closely into cyber security. For example, is there a contingency plan if a large number of IT staff get sick? Are hospital-issued laptops and repurposed IT equipment disinfected properly? Are vendors shipping safe goods? If a cyber security attack affects technology tools at a hospital, who retrieves that device for forensics purposes? Do they have protective equipment to keep them safe? All of these considerations must be a part of an incident response plan.
The business a
Jamal Hartenstein, Cyber Security Expert
Jamal Hartenstein is prior unified security management (USM) in military intelligence. He’s worked with the department of defense on military bases, as a part of joint task forces and has experience with every branch of service. He’s helped with cyber security and data privacy initiatives for hospitals, federal agencies, pension funds and other private sector industries.
The Past: Not best in class Jamal is wary of thinking that everything was ‘wine and roses’ prior to the global pandemic. He’s aware that some organizations had it right- they were leading edge thinkers as far as cyber security. But most organizations were (by definition) not best in class. “The reality was that the threat vectors were more so contained within an enclave or an enterprise of a known like end points. There was easy to wrap your head around BYOD or CYOD policy. There was a CMDB [configured management database] that was probably accurate at one point but that’s if you were a mature enough organization.”
The Present: Not prepared And so even if you’ve gotten to today without a major breach Jamal points out that with a completely new and 100% remote technology stack, “there is not an understanding of what data is entering our enclaves or enterprises.” He quickly follows that there is also not a complete understanding of where it's entering from via what equipment. That ‘completely new’ terminology is not for all, but it’s for most as, “not every organization was capable or mature or had a sophisticated remote work toolkit in place.” This has all lead to a threat landscape that has “expanded exponentially.”
It’s not that Jamal’s outlook is bleak; he’s just concerned that those that have not been subject to major incidents do perhaps not understand the past correctly which means that they’re not dealing with the present with a suitable approach.
He focuses on a would-be executive who feels that they remain prepared for CCPA or GDPR because they just had an assessment done in January. “Well in January, your work from home workforce and your threat landscape was dramatically different.” Beyond dealing with the traditional issues associated with a breach, “the settlements and fines and fees or payouts after data security, breach litigation are oftentimes much more than the cost of remediation or mitigating audit findings or a Cyber Security assessment.
The Future: Still time to improve Jamal’s industry assessment is that there are some that have not felt the actual tectonic shift that’s occurred for humanity and thus, cyber security. His point is that everything is different now- whether you feel it yet or not.
And so, with that understanding, he parts with...
Five Pieces Of Advice Investigate new forms of data protection Ensure you have multifactor authentication Focus on encryption at deeper layers in the OSI model Realize the protection data in transit and data at rest Revisit your mitigation factors The bottom line- prepare yourself to address the new threat vectors on your new landscape