Page 42 - Security Today, April 2022

INDUSTRY
With Mark Herrington
Defining a Role
The sudden long lines at gas stations in the United States, last May were for many, a surprising sight. Indeed, the situation emerged without warning: A ransomware at- tack disabled computer systems for a major regional provider, Colonial Pipeline, creating shortages and panic-buying. In North Carolina alone, 68 percent of gas stations were out of gas.
The scenes clearly illustrate an emerging conundrum for or- ganizations: Cyber security and physical security are converging. As more systems become interconnected, business operations in- creasingly depend on digital infrastructure to manage everything from the supply chain and power grids to intellectual property.
CASCADING EFFECTS OF DYNAMIC RISK
In 2021, organizations contended with several massive-scale threats, including.
• One of the largest disruptions of supply chain availability the
world has ever seen
• A record year of security vulnerabilities, particularly to our criti-
cal infrastructure
• The deadliest year for major weather disasters in four years
• The worst assault on the U.S. Capitol since 1812
• An all-time high in the number of people working from home
In fact, 99 percent of security and risk management profession- als experienced a critical event in the past 18 months, according to a commissioned study conducted by Forrester Consulting. These incidents show no signs of abating. The wide scope of such critical events means no business function or industry can escape the impact.
It is also clear from this list that threats are no longer isolated events. In the modern world, risk is dynamic and complex. Risk A has a high potential to evolve into Risk B. That is, a hacker may steal intellectual property from your most important supplier and potentially impact your operations or revenue goals, as the fol- lowing examples show.
Supply chain. Hackers breached the servers of Quanta Com- puter, stealing and leaking proprietary schematics of Apple prod- ucts. Though the attack didn’t affect Apple’s business operations, the threat to a supplier underscores the fragile link between digi- tal and physical assets.
Critical infrastructure. During a breach of a Florida water treatment facility last year, a hacker reset chemical levels to a po- tentially dangerous range. The event significantly concerned the Biden administration, which announced plans to bolster security for the sector.
People safety. A ransomware attack can delay or even prevent hospitals from providing critical patient care.
This conundrum – that cyber risk rolls into physical risk – is transforming the chief security officer’s role.
Faster than expected, they’ll need to almost think like a CEO and take a wider view of organizational risk and a more proac- tive role in responding to these new realities. To get there, here are three key changes you can make right now.
Cultivate a culture of organizational resilience. An initiative as important as this must start at the top, with a leadership vision
42
that outlines what organizational resilience means to your busi- ness. Achieving a culture of organizational resilience will require both a shift in thinking as well as a new framework.
The convergence of cyber and physical security points to what should be an obvious fact: Leaders should recognize their func- tional areas are no longer unique, separate operations. They often overlap or intersect, impacting others. With disrupted events so tightly correlated, collaboration among teams isn’t simply a nice to have. It is table stakes.
The interconnectedness of systems means risk can no longer be handled by individual teams. If a physical threat emerges from a security breach, you’ll need help from human resources, finance, corporate communications, disaster recovery, enterprise risk man- agement, IT, cyber security and physical management, etc. That is why it’s crucial to bring together the right people from across the organization and agree on common objectives and goals.
Eliminate operational silos. With the right people at the table, look at what’s keeping you from accomplishing your vision. What are the pain points – both operationally and externally – hinder- ing you from mitigating risk?
Often, decision-making happens in silos and stands in the way of resilience.
The key to breaking down operational silos is a unified view of risks impacting the whole business. Once you can see the big pic- ture, it is time to expand business continuity programs so you can manage risk more effectively. You’ll need to evaluate and document the risk appetite and tolerance levels of each functional group for product or service delivery disruptions to their internal and exter- nal stakeholders. Finally, ensure everyone is on the same page and reaching for the right goals with a set of combined metrics.
Embrace AI and automation. Organizations have more data and information than ever before. In fact, with 2.5 quintillion bytes of data now being created daily, 90% of the world’s data has been created in just the last two years. New information is being created, and at times replicated, every second.
It is no longer humanly possible to monitor and track devel- opments even within your own systems, in a timely manner. AI- powered risk intelligence will help you monitor dynamic risk at scale. Automation can be used to identify and act on the cascad- ing impact of a cyberattack, from activating response teams to alerting those who may be impacted.
It is not enough to know a storm is coming. For faster, bet- ter decisions, you also need to know which operations may be affected and which employees are in the path. A single platform combining big data, artificial intelligence and automation of key resilience processes is your best bet for a 360-view of any critical event impacting your business.
The key is you don’t have to sit and wait for the next crisis be- fore you manage it. Much can be done in advance – from identify- ing the right teams to engage to uncovering the gaps and breaking down silos.
Mark Herrington is the CEO of Onsolve.
APRIL 2022 | SECURITY TODAY
PROFESSIONAL