Understand Customers’ Preferences and the Impact on Customer Experience

Companies must understand how customers value data privacy, convenience, and the trade-offs between them. They are likely to react badly if their data are at risk because there is no protection against cyber-attacks, but if all the controls that companies install to manage that risk make their experience too painful, then they are also likely to turn their backs on the product. Standard customer research methods such as polling and focus groups can help companies understand the pain thresholds, and the business can observe customer behavior and reactions to different pilot approaches and combinations of controls, in the same way they would test the options of other nonsecurity features.

An online brokerage measures how long it takes, on average, for customers to complete a variety of tasks on its sites and then assesses new security controls on the basis of the additional time, in seconds, that they will add to important customer activities. These additional delays become part of the design and launch decision, with the business actively engaged in making trade-offs between customer experience and the security risk. If a particular control significantly hurts the customer experience, then the business can either decide to spend more to optimize the control and improve the experience, delay or cancel the feature that requires the new control, or sign off and accept the additional residual risk. Banks have learned that customers can view additional authentication layers as a positive. One institution tried to improve the customer experience by replacing its personal identification number (PIN) requirement with device recognition, so that the PIN was not necessary if a customer logged in from his or her own laptop or smartphone. Rather than appreciating the convenience, customers in fact contacted the bank because they were concerned that the security was broken. The bank reinstituted the PIN process.

In business-to-business (B2B) markets, less formal methods can be effective—it can often be enough to talk to customers on a regular basis. In some companies, informal connections with customers’ IT security teams can provide invaluable insight into those customers’ rising expectations that data will be protected and how those expectations will be translated into terms and conditions or decision criteria in upcoming requests for proposals (RFPs).

Incorporate Cybersecurity Costs and Considerations into Commercial Business Cases

New products often create new types of data or new ways of interacting with customers, which in turn create new vulnerabilities. The cybersecurity team therefore needs to make sure it has input before a new product is launched—and ideally even earlier in the product development cycle to avoid wasted or misdirected resources. The head of cybersecurity at a financial information services provider simply refuses to approve the business case for a new product until he fully understands the costs of securing the information assets associated with that product. He is fortunate to have that much power—not every CISO has an effective veto—but senior managers at the company understand the importance of security for their service offerings, and so they strongly support this requirement. They do not want to encounter unpleasant and costly surprises down the road, and they want to make sure their customers have full confidence in their security.

Build Security into the Product Development Process

The overlap between IT and product has steadily increased, even in many more traditional industries. Medical diagnostic tools are, in essence, network-connected computing devices that bear a health care logo rather than a technology provider’s logo on the box. New cars can have as many as 100 million lines of code.¹ Even thermostats now connect to the Internet. Unfortunately, organizational structures have not moved as quickly as product characteristics. In many companies, there are organizational silos that divide information technologists working on new business products from their counterparts in the core IT organization. As a result, it is much harder to get an end-to-end view on risks and vulnerabilities across network-connected products and the IT applications used to manage and support them. This increases the risk that attackers could steal customers’ sensitive information or sabotage their business processes.

Companies need to increase their level of focus on the cybersecurity aspects of business products and build links between product engineering and corporate cybersecurity teams. One industrial company named a group-wide head of product security, ensured that each business had a head of product security, and created forums for the product and corporate cybersecurity teams to collaborate on assessing risks and prioritizing remediation actions.

Align Product Development Processes with IP Risks

Product development and R&D teams typically handle some of a company’s most sensitive intellectual property—information that could be devastatingly damaging if it fell into the wrong hands. However, imposing too many restrictions on the flow of information can slow innovations and add months to development efforts, which can also be damaging if a competitor is able to launch first. In some sectors, such as outsourced contract electronics manufacturing, we have seen companies adjust their business processes and risk appetite based on a better understanding of their exposure. A company with short product life cycles accepted the risk associated with a freer flow of information in order to maintain its rapid time to market, while another company, whose product life cycles were measured in years rather than months, decided to tighten its security controls to reduce the risk of sensitive plans leaking to competitors. The end results are different, but what the two have in common is a cross-functional approach to balancing the competing demands for speed, collaboration, and security.

Support the Sales Force in Explaining Security Capabilities

Typically, only the CISO’s team can effectively explain the diligence with which a company will protect its customers’ data. The topic and language are too arcane for nonexperts to readily grasp, but this means companies must ensure that the cybersecurity team has the time to offer this support to the sales force. The team is also likely to need coaching in order to be effective in front of demanding customers—cybersecurity experts are not hired for their sales skills after all. We know of one health insurance CISO who spends a third of his time on just such sales activities, and naturally this has had a positive effect on the overall relationship between security and the business. The CISO was helping the sales force win business, not standing in the way. Companies must also ensure that the sales teams understand the importance of turning to the CISO’s team when they need to address customer demands and concerns.

Create Explicit Guidelines for What Guarantees Can Be Included in Contracts

As concerns about cybersecurity grow, business customers are making ever more forceful demands of their suppliers in terms of liability, inspection rights, or procedures for handling sensitive data. One insurer received a request from one of its largest customers to purge almost all of its data after underwriting. This was an impossible request to fulfill as regulators in some jurisdictions required the insurer to retain the data for many years. Suppliers need to understand therefore exactly what they are willing (and able) to promise in contracts before negotiations begin.

Many commercial contract negotiations get bogged down in discussions over unlimited liability. Customers want suppliers to accept unlimited financial responsibility for the economic implications of any breach it causes. Suppliers are naturally loath to agree. As the cybersecurity market matures, some suppliers are considering buying insurance to cover this risk—up to whatever amount the customer requires—and then explicitly incorporating the premium into the deal structure, passing the cost on to their customer (we discuss the nascent cyber-risk insurance market later in the book). This simplifies the responsibility for any breach, and clarifies the direct economic impact for both the supplier and customer.

Companies must invest in educating the sales teams, procurement groups, and legal staff on all these security and compliance requirements, and determine when they should reach out for more specialized support.

Redesign Core Processes to Minimize Business Risks

One of the most powerful business process changes for reducing cybersecurity risk is purging sensitive but nonessential information, and then segmenting interactions based on a thorough “need-to-know” analysis. A property and casualty insurer has adopted this mind-set and is splitting off those claims related to high-visibility litigation, so only the best-trained and most trusted claims agents will handle them. Although this means fewer agents are able to handle any claim that comes in, this reduced flexibility is balanced by the reduction in risk that comes from fewer people handling the most sensitive claims. In a similar vein, an aerospace manufacturer segments its design teams based on the sensitivity of the engineering work so that collaboration is uninhibited within the team, but any valuable intellectual property (IP) is prevented from spreading across the whole department. Some of the “flattening” that organizations have been pursuing for operational efficiencies may have inadvertently introduced greater exposure, in a similar way that creating single, flat network environments may increase risk compared to a network that is segmented based on the sensitivity of information.

In short, an organization needs to ensure that its IT systems provide users (internal or external) with only the minimum information necessary for them to perform their work. Any more access puts the organization and its information assets at unnecessary risk. For example, a vendor that provides a specific IT service should be able to accomplish its duties with virtual private network access to a segmented part of the network, or a virtual desktop interface, rather than being given the considerably riskier system-level administrative credentials and controls. The vendor management team will not typically manage the detail of vendor access controls directly, but they should actively be involved in this discussion with the IT security team.

Give Cybersecurity Team the Mandate to Set Network-Connected Device Policies

Many sectors are seeing a dramatic increase in operational devices that are connected to corporate networks but are managed outside the IT organization (e.g., medical instruments, production line control equipment, sensors). These devices are computers in all but name, but security has not always been a priority for their developers, as they are often devices that have evolved in technological sophistication over time and therefore are not viewed as computing devices. For example, x-ray and other imaging machines have moved from analog devices using physical film to digital devices based on image files. Nor do the people managing them in the business always have the necessary experience or expertise to secure them without more specialized support. As a result, companies have to rely on the cybersecurity team, which means the team needs both the insight to understand and the authority to assess these devices and put the required defense mechanisms in place. This can go beyond just setting requirements and includes incorporating security specialists into the design and engineering teams for products, just as they would be incorporated into a secure development process for new software.

Apply a Risk-Based Approach to Vendor Assessments

Institutions still have tens of thousands of vendors (one hospital network we know has almost 30,000!). Without effective vendor governance, it is all but impossible to understand which vendors have what type of sensitive information. Risks to information assets should therefore join more traditional objectives, such as cost, quality, and operational control, as important drivers for vendor rationalization—it cannot be an afterthought.

However, even after introducing effective vendor management, large organizations will still have thousands of vendors: there are simply too many different types of specialized services, too many locations that require local providers, and too many different types of software for the number to be much lower. A thorough cybersecurity assessment of each vendor would grind contracting to a halt, so sophisticated companies are determining the depth of analysis needed based on the types of information transmitted, the size of the relationship, and the nature of the connection with the company’s technology environment. Just as companies need to prioritize controls and apply different levels of protection to different information assets, they also need to create appropriate vendor management processes that match the level of exposure. One way to create efficiency for smaller vendors with lower risk is for security and procurement teams to collaborate across companies to standardize assessment questionnaires so that vendors will not have to respond to a slightly different set of questions from each new customer. Major partners such as outsourced manufacturing or infrastructure providers can start from standardized reviews and audits, but the value of the relationship and the extent of exposure would require a more hands-on and customized approach.

The organization should outline which function is ultimately responsible for managing vendors (e.g., a central risk function vs. the contracting function), the amount of access and risk that is acceptable to expose through third-party vendors, and the governance processes in place to review and manage this vendor. Critically, these policies should also outline steps to terminate noncompliant vendor contracts; one CISO deplored his company’s vendor management function, complaining that he had never seen a vendor contract terminated despite poor information security risk management.

Keep Some Negotiation Power When Defining Vendor Security Requirements

There is an intrinsic tension between the security requirements a company imposes on vendors and the negotiating power it has over them. The more stringent the requirements, the fewer vendors will qualify and the less room to maneuver the company has. One manufacturing company had nine vendors respond to an RFP, only to see that set winnowed down to just two qualifying candidates based on compliance with security requirements. To avoid situations like this, procurement and security teams will have to assess RFP security requirements in the context of common market practice, aggregate business risks, and overall contract economics. Expecting vendors to comply with a customized set of standards will tend to narrow the participation pool, while grounding requirements in industry or international standards enables more vendors to participate without needing to meet bespoke requirements.

At the same time, vendor contracts, service-level agreements (SLAs), master service agreements, and any other documentation should be consistent with established vendor management policies. Ideally, these would lay out acceptable and required behavior for vendors’ management of information security risks, including regular security reviews and tests, employee background checks, data encryption and storage, and disclosure of breaches. SLAs should outline minimum performance levels for services that could be affected by security issues, for example, network availability for online Software as a Service applications.

Reduce the Number of Vendors

One large company, because of historic governance challenges, had nearly 2,000 IT vendors (of whom 700 had truly sensitive data) and about 25,000 vendors overall. Even the most disciplined organization cannot exercise oversight fully across that many vendors. Cost and service quality will typically be the primary driver for vendor consolidation, but the CISO must add his or her voice to the discussion, pointing out that a proliferation of vendors vastly complicates the task of tracking who touches what data and ensuring that vendors comply with company security policies.

Ensure Transparency for Employee Responsibilities

As more companies allow employees to bring their own devices to work, the line between corporate and personal technology can blur, and employee responsibilities about how they can use smartphones and even laptops can become ambiguous: What software may they install on their own device? Which devices can they connect to corporate networks? To make sure employees see security policies as fair, both cybersecurity and HR teams need to make sure that employees understand what is expected of them and the potential consequences for failing to meet those expectations. We address communication and other mechanisms to create and reinforce this culture in greater depth later in the chapter.

Align Insider Analytics with Corporate Culture

Increasingly, cybersecurity teams use sophisticated analytics to identify employees who may be exfiltrating sensitive information. These analytics can go far beyond IT-usage information. Precursors of insider risk such as financial difficulties, performance reviews, and plans to leave one’s job are often visible to the HR team but invisible to the cybersecurity team. Balancing employee privacy with protecting information assets will depend on corporate risk tolerance and culture and the regulatory environment of the relevant jurisdiction. Already, some defense contractors and hedge funds ask new employees to sign their life away in terms of the level of surveillance they agree to. In other sectors, this level of intrusiveness would be hard to imagine or even illegal. Regulatory requirements need serious consideration and appropriate legal review. The availability of extensive online employee surveillance is uncertain in some U.S. states and many parts of Europe. As a result, it will be up to senior management to determine how deeply these analytics should delve, and cybersecurity and HR will both need to help them strike the right balance, as informed by legal and compliance professionals.

Collaborate with Compliance Functions to Understand Regulators’ True Bottom Line

In our interviews, we heard again and again that compliance is not security, that regulators tend to apply a checklist mentality, and that regulatory standards may be years out of date compared with the latest defense mechanisms. Managing the regulatory environment will always be challenging, but there are ways cybersecurity and compliance teams can cooperate to mitigate the impact. Given regulators’ affinity for process, providing them with transparency into mechanisms for assessing risks, prioritizing investments, and setting policies can increase their comfort level; avoiding margins placed on top of regulatory guidance may be even more important. One financial institution accepted significant inefficiencies in some of its core IT processes in order to comply with—its managers believed—regulatory mandates. The compliance team helped determine that in fact many of the most inefficient constraints stemmed from perceptions of what the regulators wanted, rather than actual regulatory guidance.

Integrate Cybersecurity into Enterprise-wide Risk Management Processes

After the challenges companies have faced since the economic crisis, boards and senior management teams focus on enterprise risks today in a way that would have been hard to imagine even 10 years ago. They depend on risk management functions to drive risk assessment, mitigation, and reporting across many different types of risks: liquidity, credit, regulatory, legal, and operational. But if cybersecurity is seen as the responsibility of IT and separate from other types of enterprise risk, then boards and senior management will not give it the required attention, support, and funding. Some of the companies that have most effectively engaged boards and senior management teams on cybersecurity have integrated the language and frameworks they use to assess, prioritize, and report on cybersecurity risks into the way they talk about their types of operational risk. For example, some banks view information security risk as a top-level risk event category, even though it is not one of the seven top-level categories defined by the international banking recommendations set out in the Basel II Capital Accord. For a life insurer, information security risk was moved from the purview of the board’s IT committee to the enterprise risk committee, where it shared the agenda with market and other business risks.

People Need Both Understanding and Conviction

People need to know what is expected of them and, crucially, agree that it is meaningful and worthwhile. This means engaging them on why cybersecurity matters and on the critical role each of them plays in protecting the organization’s assets. This is often where organizations are relatively strong—the other three mechanisms typically need the most improvement

People Need the Skills to Enable Them to Behave in the New Way

For example, businesses need to integrate material on how to handle documents securely into broader training sessions and employee induction days. Part of this can be basic technology controls—if encryption is required for certain kinds of information, then that software needs to be provided (or, better, automated). The other pillar is moving beyond “what and why” types of communication into “how” conversations that use concrete examples to help employees understand and incorporate new behaviors. For example, an aerospace manufacturer added a security management module so that an engineer joining a team working with an external manufacturing partner would learn the security protocols at the same time she learned about collaboration methods, team schedules, and so forth: security was part of the core training, not a secondary measure.

Senior Leaders Need to Role-Model the New Behaviors

Role-modeling is essential to reinforce any requirements or behaviors and to embed the idea that this matters and is taken seriously by the leadership. If someone sees their boss (and their boss’s boss) treating customer information with respect, not talking about sensitive data in public, and voicing disapproval when security protocols are not followed, then they know to take the rules seriously. On the flip side, if their boss mocks the rules or shows active resentment and a “game the system” mentality, then the official and implicit messages come into conflict and many employees will align with their supervisor’s viewpoint.

Leaders Need to Reinforce the New Behaviors through More Formal Mechanisms Such as Incentives

There are usually clear penalties for egregious misuse of corporate technology resources, but incentives that reward good cybersecurity behavior are scarce. Many companies test to see how many employees respond to a phishing attack. Very few, however, track phishing hit rates over time and build them into senior management scorecards and incentives. At the most basic level, security performance can be incorporated into performance indicators and dialogues. For greater effect, security behaviors can be included as part of compensation and performance reviews, together with other types of risk. People tend to prioritize what is measured and what is rewarded (and punished), so if cybersecurity is not included, then that sends an implicit message about the priority of security needs.

● ● ●

Policies and processes in every part of the business—product development, marketing, sales, operations, procurement, HR, risk, and compliance—affect a company’s ability to protect its information assets. Decisions and actions on the part of frontline users in every part of the business matter just as much.

Making the right changes to policies, processes, and user behavior requires a high degree of collaboration between the cybersecurity team and the rest of the business. Too passive a posture on the part of the cybersecurity team would mean forgoing important levers in protecting information assets, but a series of mandates formulated without business input could have a dramatically negative impact on productivity.

Naturally, cybersecurity teams will have to develop a nuanced understanding of business practices and processes to develop realistic options for changes that will protect information assets. However, they cannot do this alone. They require active support from a range of senior managers: business unit executives have to help synchronize customer offerings, product designs, and end-to-end processes with security requirements; procurement managers have to help strike the right balance between vendor security requirements and contract economics; compliance managers have to help align regulatory mandates with the company’s risk reduction priorities; and managers in every function need to communicate and reinforce the expectation that frontline users will understand the value of and protect the information assets they use every day.