Lower Frontline Productivity

Compared to even a few years ago, companies have many more security controls in place that limit how employees can use technology. They prevent users from installing applications on their desktops. They turn off USB ports and block access to consumer cloud services such as Dropbox. They prohibit executives from taking their laptops to certain countries or require that the laptop be reimaged on return. Layers of security controls can even make turning on a desktop or laptop a prolonged and frustrating process at some companies.

Cybersecurity teams may have good reason to implement these measures. Unknown applications can contain malware that antivirus programs can’t detect. USB ports can be a source of infection, and both USB ports and consumer web services can be a mechanism for inappropriately copying sensitive data.

Employees, however, can see such measures as draconian. Worse, they can directly affect productivity and morale. The salesperson can’t hand a USB stick with a video about a new product to a potential customer. The executive traveling overseas has to spend time copying her contacts onto another disposable phone before the visit and is unable to access Skype from her laptop to speak to her husband back home while away.

Security controls also limit frontline experimentation, which has been the source of so much of the value users derive from IT. In the 1980s, the first bankers who started using Lotus 1-2-3 to construct pro-forma models didn’t have approval from corporate IT. Twenty years later, IT had no idea that small groups of executives had started using Blackberries to communicate with one another. Today, such innovations would be an explicit violation of most large companies’ information security policies.

As a result of these factors, 9 out of 10 technology executives say cybersecurity controls have at least a moderate impact on end-user productivity; in the high-tech sector, 60 percent say the impact on productivity is a major pain point. A senior technology executive at a large bank said that if the CEO realized how many hours were lost as employees struggled with security controls, “he would hang us all.” The CISO for a high-tech firm said he was convinced that the security controls he had to put in place contributed to talented engineers leaving the company.

Unfortunately, in many cases, restrictive security controls do not even solve the initial problem. They can lead users to circumvent corporate IT entirely, ironically increasing the risk dramatically. For example, at one securities firm, many bankers became so frustrated by long boot-up times and other controls that they stopped traveling with their IT-issued laptops. Instead, they just bought cheap laptops with no security controls and used free web-based e-mail services to communicate with each other.

Even government employees find workarounds. In a 2010 survey of U.S. federal officials, just under two thirds said security restrictions prevented them from getting information from some websites or using applications related to their jobs. The solution: using a nonagency device to access the information they need. In fact, more than half said they accessed information from home instead of from the office to get around the security controls.¹

Less Money for IT Initiatives that Create Value

Direct cybersecurity expenditures are small compared to overall IT budgets and business revenues, but cybersecurity still diverts resources away from IT projects that create value because of the downstream effects it has on other IT functions such as application development and infrastructure.

It is hard to get a handle on how much companies spend protecting themselves from cyber-attacks. Some security-related functions, such as firewall management and identity and access management (I&AM), may be located in security budgets or may be found elsewhere in IT. This, as well as differences in security posture, means that there is a large range in how much companies spend on their cybersecurity function. Most commonly, cybersecurity organizations represent between 2 and 6 percent of an IT function’s budget, though we know of some companies that dedicate as much as 8 or 9 percent—typically those with stringent requirements or that are in the middle of large programs to improve their security capabilities (Figure 1.1).

Although cybersecurity is growing more quickly than other areas of enterprise IT, direct cybersecurity expenditures do not appear to be that big an issue for most companies. While some of the largest banks and telecommunications firms can spend several hundred million dollars on cybersecurity, many other large companies spend much smaller amounts. For example, a $25 billion manufacturing company that devotes 2 percent of revenues to IT and 5 percent of that IT spend to cybersecurity would be spending just $25 million—a financial nit. Of the $2.1 trillion in global enterprise IT spend, only about $90 billion falls the into cybersecurity budget, of which three quarters goes to hardware, software, and services, and the other quarter on internal labor (Figure 1.2).

Many technology executives believe that they already spend enough to protect their companies. Slightly more than half of those we interviewed said their company spent about the right amount on cybersecurity, while only about a third said that their company spent significantly too little. Some CISOs told us that they received whatever budget they asked for. For them, the constraint is the lack of available talent rather than money. Cisco estimates that the gap between security roles that need filling globally and the talent available may be as high as 1 million professionals.² Almost all CISOs told us they could get approval for more head count but cannot hire quickly enough to fill the slots that they have.

CISOs’ perceptions of their budgets did vary significantly by sector. More than 60 percent of financial services and high-tech companies said they had big enough cybersecurity budgets. But less than 40 percent of insurance companies and only about a quarter of health care companies felt the same. Nearly two thirds of health care technology executives say their company’s cybersecurity budgets are significantly too small (Figure 1.3).

Cybersecurity’s cost increases dramatically when it includes the indirect security activity undertaken outside the security organization itself. Not only do many organizations perform some security-related functions outside IT security, but many actions the security organization takes create unfunded mandates for application development, infrastructure, and the broader business groups. Developers spend months or years rearchitecting applications to meet security standards; network teams spend tens of millions of dollars reconfiguring networks to make them more secure; system administrators devote countless hours to applying security patches across tens of thousands of servers; and after years of infrastructure optimization, many IT departments can provision a server in hours or days, but then spend three or four weeks doing the security-related configuration, with all the cost that implies.

We asked CIOs, CTOs, and CISOs to estimate how much of the nonsecurity IT budget is actually spent on security. Quite frankly, many had no clue but were sure it was large. Many of those that offered a figure said it could be 25 to 30 percent of the budget, which would imply that the combination of direct and indirect security activity is consuming a third of IT budgets.

In a world where business aspirations for technology innovation bump up against constrained IT budgets, where business leaders complain bitterly about the cost of developing and running applications, and where there are pitched battles about which projects IT can afford to do each year, this means security requirements are diverting significant resources away from IT that creates value.

Slower Adoption of New Technologies

CIOs and CTOs have a crowded innovation agenda. Senior executives, customers, and ultimately shareholders expect them to roll out new capabilities in areas including cloud computing, big data, e-commerce, the Internet of Things, mobile commerce, and enterprise mobility.

Almost everyone told us that security is often the bottleneck in implementing new technologies. It takes real work to assess vulnerabilities in new vendor offerings and to figure out how to engineer a secure solution. For example, the security team has to assess new types of mobile devices to determine what data they store locally and how strong the authentication mechanisms are that prevent unauthorized access. It has to assess new external web-facing functionality to see whether it creates an entry point into customer-facing systems that attackers can exploit. It also has to analyze how an attacker would penetrate a new capability, identify potential vulnerabilities, and engineer controls that are acceptable in terms of cost and convenience.

All these tasks take time, especially for relatively new technologies that have not been extensively pressure tested in the real world, and can significantly delay the introduction of new capabilities. The CISO of a medical devices company explained that it took a year to work out how to integrate the network-connected devices into an operating room environment in a secure way.

For many technologies, the lag time is relatively small—at least so far. IT executives told us that security requirements added less than three months to the implementation of big data analytics, mobile servicing, online servicing, and online payments. Many explained, though, that the business imperatives were such that there was no alternative to rolling out new technologies, even if the security issues were still unclear.

The impact of incorporating security measures is felt most keenly in cloud computing and mobile (Figure 1.4). On average, enterprise mobility capabilities were delayed by more than six months and public cloud capabilities far longer, with many companies saying they wouldn’t put sensitive data in the public cloud in the foreseeable future because of security concerns.

Delays in enterprise mobility are driven largely by what many CISOs perceive as a rickety enterprise mobile security model. A financial services CISO told us, “We’ve started to experiment with mobile devices; however, the delay has been because of the number of potential threats they create.” The CISO of a hospital network faces similar challenges. “We’ve got thousands of physicians who all want access,” he said, “but who also want to do their own thing. We have had to make sure everything is going between them securely, so naturally a few of the systems have been delayed.”

The result is that most organizations have focused on a relatively narrow set of mobile capabilities such as e-mail and calendar synchronization, that give users only a small fraction of the capabilities they would have on a laptop.

Delays in the use of the public cloud are driven by multiple factors. While some executives highlighted reasons unrelated to security (e.g., compliance considerations or “not invented here” syndrome), a few explicit security considerations came up frequently in interviews, specifically, a perceived lack of transparency into many providers’ security models, a sense that multitenant public cloud architectures lack the defense in depth that a well-designed local environment provides, and uncertainty about how contract terms and conditions can be crafted to address cybersecurity concerns.

As a result, 60 percent of executives surveyed said that security concerns were delaying their institution’s use of cloud environments by a year or more. As we’ll see in the next chapter, such delays, when spread across the global economy, could have major economic implications.

Many CIOs also worry that concerns about cyber-attacks could slow down adoption of the “Internet of Things”—the connection of devices from refrigerators and thermostats to automobiles and heavy machinery to the Internet. It’s easy to understand the trepidation in connecting cars to the Internet if attackers could exploit those connections to wreak havoc or even just monitor movement. Cybersecurity researchers in Israel have already proven they can take over a car remotely.³

Regulatory scrutiny can add further delay to the rollout of technology innovations. One bank underwent 98 regulatory audits in 2013. When a company has to explain how a new technology can be secured to dozens of different regulators, each with a different agenda and questions, the pace of innovation can slow dramatically.

Companies Must Contend with a Wide Range of Risks and Threats

As digitization continues to increase, companies face a broad range of business risks associated with cyber-attacks.

The Risks Are Strategic

Faced with so many potentially damaging outcomes, technology executives across sectors and regions are highly concerned about the risk of cyber-attacks. Roughly two thirds described it as a significant issue that could have major strategic implications over the next few years. Typically, they explained their perspective in terms of the risks laid out earlier: lost intellectual property, lost customer data, or disruptions to business operations. A relatively small percentage, about 10 percent, described the risk of cyber-attack as existential and believed it could “turn out their lights sometime in the next five years.”

Turning out the lights would mean either a devastatingly destructive attack or, more likely, an irreparable breakdown of customer trust. The CISO for one social media company said, “If we lose customer trust, then the product itself goes away.” The CISO for a large financial institution said that he was worried about attacks that would compromise transaction data so comprehensively that it would be impossible to unwind.

About a quarter of the people we interviewed believed cyber-attacks are a normal risk of doing business. These executives placed cyber-attacks in the context of other risks facing their institutions, such as liquidity crises for banks or physical disasters for manufacturing companies.

Interestingly, not one person we interviewed agreed with the statement, “The risks of cyber-attacks are overblown. Our institution has the issue well in hand.” In fact, cyber-attacks were a much greater concern than other types of technology risk. Nearly three quarters of respondents said that external cyber-attacks were one of their top two technology risks. Nearly 60 percent said the same about insider threats. Other technology risks were rated in the top two less than a third of the time. These included disaster, poorly designed application code (which cost Knight Capital $440 million¹⁷), and inadequate quality in technology operations such as mistakes in server configuration that crash important applications (Figure 1.6).

Although the level of concern varied barely at all across sectors, the types of risks each sector worries about are quite different (Figure 1.7). Broadly speaking, services companies prioritize theft of customer data and interference with business operations, while product companies prioritize industrial espionage. For example, barely any financial institutions cited industrial espionage as a prime concern. Investment banking CISOs told us that although IP was incredibly important to their business, its structure and format limited the impact of any given breach: trading algorithms were immensely valuable, but the IP was distributed across many algorithms on many product desks (e.g., currencies, interest rate swaps) so the loss of any one algorithm would have only so much financial impact. In addition, many of the algorithms changed rapidly, so any IP stolen would have far less value in just a matter of months. Some retail banking CISOs placed an even lower value on their company’s IP; one said, “Checking products aren’t all that different from each other and don’t change that quickly.”

Instead, banks worry about fraud and any breaches that might compromise either corporate or consumer customer data—they considered this to be a core part of their institutions’ value proposition. Many also expressed a high degree of concern about politically motivated attacks on the integrity of financial transactions.

High-tech companies, by contrast, are sharply focused on IP loss, especially process-related IP. Detailed insights into a product become widely available the moment it hits the market and competitors apply tear-down techniques to it, but the detailed manufacturing specifications (e.g., what temperature to bake a component at) can stay secret for years.

Technology Changes Favor Attackers

Almost everyone accessing corporate systems used to do so from a desktop computer owned by the corporation and physically located within a company office. Information security professionals focused on defending the perimeter and keeping attackers off the corporate network. Today’s world is very different. There are endless ways into networks, vastly expanding each institution’s exposure. Customers can access sophisticated applications via the Internet; business partners can connect directly to the corporate network, which enables tighter collaboration but adds to the external interfaces; and users expect to access everything no matter where in the world they happen to be. The idea of an invulnerable “perimeter” is as old-fashioned as a moat. Companies are also littered with older IT systems that may rely on outdated and vulnerable technology and that are retired very slowly. Attackers therefore have a growing array of opportunities to exploit.

Attacker’s Jurisdictional Advantage

In the physical world, if a criminal keeps committing crimes, the odds are that he will eventually get caught. All it takes is one slip-up, one caper that puts him in the wrong place at the wrong time. For a cyber-criminal operating from a country not focused on prosecuting cyber-crimes, the story is very different. Rather than increasing his risk, each incremental attack sharpens his capabilities and makes him smarter about the company he’s attacking. “The attacker has to be right only once to do a lot of damage but can get away with being wrong time after time,” said a CISO. “We have to be right every single time.”

The Resources Available to State-Sponsored Attackers

Several CISOs told us that although they have a fighting chance in defending themselves against criminals and hacktivists, they cannot compete with the resources that a nation-state can bring to bear in cyber-espionage. Not only are some states technologically advanced, but they can also afford to devote dozens or even hundreds of people to probing just one company’s technology environment for vulnerabilities.

State-Level Capabilities Being More Widely Disseminated

Sophisticated attack strategies developed by states don’t necessarily stay exclusively in their hands. Cyber-warfare unit leaders may pass on attack strategies to groups they believe might be politically useful. More junior members meanwhile may seek to augment their salaries by freelancing the skills they’ve developed. Kristin Lord of the Center for a New American Security said, “We’ve already seen indications of states using criminal groups as proxies for attacks. We also know that countries like North Korea are aggressively trying to develop their cyber capabilities. The open black market, which already exists in the criminal world, is therefore a big concern. It provides a place for states and criminals to find each other.”¹⁸

The Global Market for Cyber-attacks

Just as the Internet has created a global market for collectable trinkets, it has also begun to excel at connecting buyers and sellers of the tools required to launch sophisticated cyber-attacks—not just the states and criminals Kristin Lord referred to, but a range of players. The Rand Institute reported that researchers who discovered a new “zero-day” vulnerability in a popular piece of software¹⁹ could earn, in some cases, millions of dollars by selling this knowledge to cyber-criminals.²⁰

Institutions Lack the Insights to Make Intelligent Cybersecurity Decisions

Risk management is at the core of cybersecurity. CISOs seek to put in place a set of controls (e.g., encryption, authentication) that deliver the greatest reduction in the likelihood or impact of important risks (e.g., loss of IP, theft of customer data) at the lowest cost and with the least business disruption. Unfortunately, the overwhelming majority of large institutions simply don’t have the required risk management capabilities to make intelligent decisions about cybersecurity investments and policies. They don’t understand the assets they need to protect, the attackers they face, the full set of defense mechanisms they could implement, or the implications of each of these mechanisms. As a result, they see too little reduction in risk, coming at too high a cost in terms of both business impact and expenditure.

To get a better understanding of where organizations stand in their cybersecurity capabilities, we asked more than 60 Global 500 institutions to complete our Cyber-Risk Maturity Survey (CRMS). The survey measures an organization’s risk management practices across eight domains—specifically, how well it understands:

• Its attackers.
• The assets it needs to protect.
• The vulnerabilities in its environment.
• Its residual risk and risk appetite.
• The range of potential controls it could put in place.
• How effective it is in assessing the cost and impact of controls it might put in place.
• How thoroughly it can implement the decisions it makes.
• The quality of cybersecurity governance and organization.

The CRMS was developed together with CISOs from leading institutions and minimizes subjectivity. Rather than asking companies to rate themselves on how well they fare in a particular area or measuring specific technologies, architectures, or controls, it asks instead whether and how frequently the company performs 28 specific activities and then grades it on a numerical scale to allow for comparisons (Figure 1.9).

There are four levels of cyber-risk management maturity:

1. Nascent. These are the companies that are doing their best but lack any rigid protocols or centralized security systems in place beyond the bare minimum. They have no defined single point of accountability or a clearly defined escalation path to top management.
2. Developing. Companies have a qualitative framework for evaluating and mitigating cyber-risks. The governance model is consistent across the company, with a single point of accountability in each business unit and a defined reporting line to top management.
3. Mature. There’s a quantitative approach for evaluating and a qualitative approach for mitigating cyber-risks. The cybersecurity governance model is well defined, with a single point of accountability within a business unit that owns the risks and decision making.
4. Robust. A robust quantitative approach for evaluating and mitigating cyber-risks is in place, and clearly identified individuals are accountable for the cybersecurity of each asset.

Companies Have a Long Way to Go to Reach Maturity

The survey results were sobering. More than 9 out of 10 organizations have only nascent or developing maturity, and not one could be described as robust overall (Figure 1.10).

Only one respondent was mature or better in every practice area, and more than two thirds were only “nascent” or “developing” in at least half the areas. Looking at the scores in aggregate, only one area—knowing your systems and people—had an aggregate score of more than 3, indicating it was “robust” in more than half of the companies. Most practices were toward the low end of “developing,” with practices around knowing your vulnerabilities being particularly weak (Figure 1.11).

What does this relatively low maturity mean in practice?

• Only one institution in six gives the CISO the authority to stop IT projects that explicitly violate cybersecurity policies or to conduct cybersecurity simulations more than once a year.
• Only one in five ensures that the board has reviewed and approved the cybersecurity strategy in detail or includes the cybersecurity organization’s impact on broader IT costs in annual performance evaluations.
• One in three enables the CISO to meet with the CEO on a regular basis, and one in three provides the board with a list of the most important information assets to protect.
• Only about half of institutions even define minimum standards for data protection for sensitive information or update intelligence about attackers more than once a year.

Maturity is weakest where specific practices reach beyond the immediate realm of cybersecurity. Areas that are directly under a CISO’s control are more advanced, but as soon as the CISO needs to reach out—even to other people in the broader IT group, let alone the business units themselves—there is a drop-off in maturity level. For example, some of the most advanced areas are the understanding of technological vulnerabilities and assessing the costs of defense systems. For these, the CISO does not need significant cooperation from the rest of the enterprise. By contrast, understanding assets requires significant engagement from business-line executives, and maturity for this practice was much lower (Figure 1.12).

Sector, Size, and Spend Make No Difference to Cyber-risk Management Maturity

Banks scored better than other CRMS participants, but only slightly, and the differences within each sector were far greater than those between sectors. Banks were relatively strong in understanding their attackers (given their investments in intelligence capabilities in that sector), understanding their vulnerabilities, and in governance. By contrast, they were little better than average in understanding potential defense systems and their impact. Insurers were relatively weak across the board, and especially so in understanding the assets they need to protect and the vulnerabilities in their existing environment. However, the more mature insurance companies far outperformed the weaker banks.

Nor were large companies necessarily more mature than smaller ones; in fact, some companies with less than $10 billion in revenues achieved some of the highest maturity ratings. This could be because transparency and coordination are easier to achieve in smaller, simpler organizations.

Perhaps most surprisingly, more cybersecurity spending does not lead to greater cyber-risk management maturity. Cybersecurity spend as a percentage of overall IT expenditures is an imperfect metric, but it does give some sense of the resources committed to cybersecurity in relation to the scale of what needs protecting. Plotting a company’s risk management maturity against security spend as a percentage of overall IT spend yielded results all over the map, with companies in each of the four quadrants (Figure 1.13).

The unprotected have the lowest level of capability. They have small security teams, invest relatively little in cybersecurity technology, and lack the insights to target their limited expenditures wisely. Senior managers at one financial institution believed that they would not be targeted because they did not operate in the United States. This resulted in a history of underinvestment and an exclusive focus on a very narrow and incomplete set of potential risks.

Institutions punching above their weight spend relatively little but are able to get more from their investments than their peers, usually because they have developed a clear idea of what assets are most worth protecting, and therefore are efficient in how they use their limited budget. At one pharmaceutical company, tight budgetary constraints driven by a weakening product pipeline and concern about IP theft forced IT to develop a set of mechanisms to understand risks and focus investments on protecting the company’s most important assets.

Highly concerned institutions typically have relatively high levels of both risk management maturity and spend. One sophisticated manufacturing company decided it had no choice but to devote significant resources to cybersecurity and to make smart decisions given the sophistication of its attackers and the expectations of its military and intelligence customers. It put tremendous focus on this issue, starting with very senior executives, and invested the time and effort to develop strong capabilities in understanding its attackers, assessing its own vulnerabilities, and putting in processes to select the highest-impact defense mechanisms. A corporate culture that tended to support and carry out policies once they had been set proved to be invaluable in achieving this.

Finally, there are companies throwing resources at the problem. They tend to have large cybersecurity teams who have implemented, or at least purchased, many of the most cutting-edge technologies. However, for all the spending, it’s not clear that they are protecting the right things or protecting them in the right way. Some institutions that have great reputations for their technical sophistication in cybersecurity fall into this last bucket. For example, one bank prioritized cybersecurity funding but failed to get the central security team, business unit leaders, and business unit IT to interact effectively. As a result, despite its sizeable budget, the central security team had limited insight into what information assets to prioritize for protection or where the vulnerabilities lay in each of the business units’ sprawling application portfolios. The inevitable outcome was a damaging breach despite the heavy investment.

● ● ●

Institutions face a daunting cybersecurity challenge. Pervasive digitization creates tremendous value but also makes them more reliant on technology, increases the stakes in the event of a breach, and enables capable and determined attackers. Institutions thus face a damaging and expensive array of risks from cyber-attacks, ranging from loss of customer data to disruption of business operations to fraud. Attackers meanwhile can improve the pace and sophistication of their attacks much more quickly than institutions can improve their defenses.

Large institutions are further hampered because they lack the facts and processes to make intelligent decisions about cybersecurity investments and policies, meaning they don’t get the maximum protection at the lowest cost and with the least business disruption.

As a result, cybersecurity, as it is practiced today, is hurting large institutions’ ability to derive value from technological innovation and investment. In the course of protecting them from real and important threats, organizations’ cybersecurity controls are reducing end-user productivity, diverting scarce resources from IT that creates value, and slowing the introduction of important technology capabilities.