Why Cybersecurity Isn't Solely a Tech Problem | HBR IdeaCast | Podcast

0:00When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a$75 sponsored job credit at Indeed.com slash podcast. That's Indeed.com slash podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored Jobs. Propel Fitness Water with Gatorade Electrolytes, Zero Sugar, and Vitamins.

0:35Propel hydrates better than water to help you get the most out of your workout and get back to your best self. What propels you? Propel with Gatorade Electrolytes.

0:55Welcome to the HBR IdeaCast from Harvard Business Review. I'm Alison Beard.

1:06From Apple and JPMorgan Chase to Marriott and British Airways, some of the most sophisticated companies in the world have fallen victim to cyber attacks in recent years. Business-critical activities have been disrupted, customer data has been compromised, and the threats continue. So what can organizations do to prevent themselves from becoming the next target? By now, most accept that they need to invest significant cash and resources into cybersecurity capabilities. But too often, this important job is left to IT leaders rather than the full C-suite and board. Today's guests say that companies need to take a much different approach, with leaders at the very top thinking about cyber risks as not just a technology issue, but a significant business problem to be solved.

1:52Thomas Parenti and Jack Domet are co-founders of the cybersecurity firm Archifact Group and co-authors of the HBR article, Sizing Up Your Cyber Risks, as well as the HBR Pressbook, A Leader's Guide to Cybersecurity. Thomas and Jack, thanks so much for being here.

2:08Thomas Parenty:We're so happy to have the opportunity to talk with you today. Thanks for having us.

2:22Presumably a lot of these companies that are hit take some precautions to protect themselves. So where are they going wrong?

2:29Thomas Parenty:We have come to the realization that essentially worldwide we're failing at cybersecurity and that in spite of all of the investment in public attention, the number and impact of cyber attacks is only rising. In some sense, that's the reason that we're talking right now. And you can think of our current cybersecurity situation today as comparable to trench warfare in World War I. The progress is negligible and the casualties are high. There are several reasons why the focus on cybersecurity and cybersecurity technology ends up undercutting its capacity to protect. First, no company has all of the resources to fix every cybersecurity issue, and not all fixes are equally important.

3:14Thomas Parenty:It's only by starting with a company's most critical business activities and how cyber attacks could disrupt them that one can start to prioritize this whole process of risk mitigation. Unfortunately, there are many companies who sort of skip the step of first thinking about what are the most important business activities that could be disrupted by a cyber attack. And instead, they end up focusing on individual technologies to fix individual problems within their computer systems. The focus on fixing these computer vulnerabilities, it's seductively dangerous because there is some value here. However, a company can spend all of its resources, significant resources, fixing these vulnerabilities without ever addressing the fundamental issue, which is protecting the business activities for which the computers were procured.

4:11So you're basically having the IT department say, well, we're compliant and best practices for a lot of these systems. when they're not taking into account the most important business functions that these systems are protecting.

4:27Thomas Parenty:There are numerous examples of vendors, including Target, who were compliant with the relevant payment card security standards at the very moment that they were successfully hacked. For certain companies, especially those in high school, When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a$75 sponsored job credit at Indeed.com slash podcast.

5:07That's Indeed.com slash podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored Jobs. Propel Fitness Water with Gatorade electrolytes, zero sugar, and vitamins. Propel hydrates better than water to help you get the most out of your workout and get back to your best self. What propels you? Propel with Gatorade electrolytes.

5:30Thomas Parenty:Regulated industries such as financial services, they are subject to so many different compliance requirements that what effectively happens is they translate in their minds being compliant with requirements as equivalent to being adequately protected. And that ends up actually diminishing the security of these companies as opposed to achieving its goal of increasing protection. So, Jack, you're the management expert. Why do organizations operate this way? Why aren't they thinking more holistically about business risks? Well, part of that starts from the fact that since its very inception, cybersecurity has been, it's come out of the technology department.

6:19Thomas Parenty:And it's been looked at in terms of an attack and defense technology paradigm versus one that's related to any other complex business risk that a company might face. Now, there's no question that, you know, given the neglect of cybersecurity over time by most companies in the past, many companies do in fact need to invest more. But as Thomas mentioned, companies like the ones in the financial services space with really large cybersecurity budgets don't nearly get the cyber protection benefit that they should given the dollars that they spend. And we have an example of one of our financial services clients that spent about$3 million a year on cyber threat intelligence.

7:01Thomas Parenty:But when we asked them for examples as to where they actually changed their cybersecurity protections or strategies on the basis of this intelligence, they were silent. $3 million year after year without any actionable result. And in your experience, is it hard to get non-tech leaders to really understand and get involved in these issues? While many companies don't do it, it isn't hard to get them engaged on the process if you change the nature of the conversation, if you change the starting point from which these conversations begin. And that really starts with looking at cyber risks as a business risk that could come and occur as a result of a cyber attack.

7:44So how do you kick off that kind of conversation with senior leaders at a company and the senior tech people?

7:51Thomas Parenty:Well, it's an interdisciplinary process. The approach that we take is that we introduce actually in the article is called a cyber threat narrative, where we bring resources from across the organization, starting with a business owner, someone who's running a business unit, someone who has responsibility for P &L to understand where are the business risks in their organization. What's actually important? What assets are critical to their operations? What activities do they do that provide competitive advantage to them and their organization and their business unit? Once those are identified, you're in a better position to engage with other resources throughout the organization to help quantify what those risks are.

8:34Thomas Parenty:And bringing in the IT department and your cybersecurity resources to understand what the threat environment might be that might affect those risks in some way or make them to come about. One of the dynamics that we are working to change is this perception on the part of non-technical business leaders that the cybersecurity field is so complex, so impenetrable, that they would never be able to understand it. And so it just is logical to delegate that or we should we actually say abrogate that responsibility to either cybersecurity or IT staff. Just as is true of every other business domain, what you need to know about it depends on your role and responsibilities.

9:22Thomas Parenty:And what boards of directors, senior executives and managers need to know about cybersecurity is significantly different. When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a$75 sponsored job credit at Indeed.com slash podcast. That's Indeed.com slash podcast. Terms and conditions apply. Need a hiring hero?

9:57This is a job for Indeed Sponsored Jobs. Propel Fitness Water with Gatorade electrolytes, zero sugar, and vitamins. Propel hydrates better than water to help you get the most out of your workout and get back to your best self. What propels you? Propel with Gatorade electrolytes.

10:15Thomas Parenty:From that required by somebody who is rolling up their sleeves and, if you will, operating on the bits and bytes of a computer. Yeah. Where have you seen a company that hasn't been using that cyber threat narrative process go really wrong and miss a big hole in their systems and be attacked? One example that comes to mind is an Asian automobile manufacturer that we worked with a number of years ago, and they had suffered a breach. And in the aftermath of the breach, the cybersecurity team was tasked with making us so secure that this never happens again. And so the cybersecurity team decided to put the network used for the development of new automobiles inside their corporate network because they thought, ah, an attacker would need to go through two networks in order to be able to then steal information.

11:13Thomas Parenty:In principle, that sounds like a wonderful idea, except there were colleagues from other partner companies that work side by side with these automobile manufacturer employees, and they were now locked out. And so the only way that they could get their work done was to create fake employee accounts for all of these external contractors. And they did this knowing that this was perhaps not the best thing from a cybersecurity perspective, but it's what they needed to do in order to get their job done. And so this illustrates a couple of points, one of which is the cybersecurity people had no idea how the company that they worked for actually designed cars.

11:55Thomas Parenty:And so they proposed security mechanisms that both interfered with work and ended up resulting in the company being more vulnerable because all of these outsiders now had complete access to the corporate intranet globally. Right.

12:39Thomas Parenty:And so they saw no issue whatsoever in going around those protections. Were they then attacked again? One of the sort of insidious things about this particular situation is because all of these outsiders were now treated as insiders, we have no idea what they did. I mean, this is a really important point because we're told not to use open Wi-Fi at cafes or ever give our password to anyone. But there are times when you just think, no, I really have to send that email out. The work needs to get done. So how should organizations walk that line between putting in proper precautions but also ensuring that people still can be efficient?

13:27Thomas Parenty:You know, we've found that cybersecurity writ large is full of platitudes that seem obvious and compelling at first read. But if you think about them more thoughtfully, they're sometimes misinformed. One example where this often comes into a play is in a class of cyber attack called phishing. People often, you know, open attachments because you read your email. And occasionally those attachments result in malware being downloaded onto their computers. But, you know, and attackers have become savvier over time. It's not just Nigerians, princes who want you to give millions. They'll do research that's specific about you to your LinkedIn account, etc., so they can deliver a very targeted attack.

14:12Thomas Parenty:Yet the common thing. When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a$75 sponsored job credit at Indeed.com slash podcast. That's Indeed.com slash podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored Jobs. Propel Fitness Water with Gatorade electrolytes, zero sugar, and vitamins.

14:50Propel hydrates better than water to help you get the most out of your workout and get back to your best self. What propels you? Propel with Gatorade electrolytes.

15:00Thomas Parenty:That cybersecurity departments typically put into place is what's called security awareness training. I just completed mine. You just did. We could then ask, what is the value that you derived from taking this security training? Don't answer that. I do think I'm more careful, but I think the big thing is the problem isn't necessarily stemming from a phishing attack. So one of the things that is important to note, and this is something that is illustrated both by your security awareness training and also by the example from the automobile company, is that while it is common for security training to talk about generic good things to do.

15:47Thomas Parenty:So if you're in a Wi-Fi hotspot, use a VPN so that the person sipping a latte next to you isn't also reading your email. But what is missing is informing employees about the cybersecurity implications of their own work. And so this requires actually going beyond a list of generic good things to do to actually looking at how an employee functions in their day-to-day work life and how the actions they perform either discourage a cyber attack from being successful or lay the groundwork for a cyber attack on the critical business activity that they are involved in from being effective. So, I mean, every company is a technology company now because we're all digital.

16:38We might all even be using all the same systems, but our cyber threat narratives will be very different if we're an oil company versus a credit card company.

16:47Thomas Parenty:Even within a company, where are your locations? What are your different business units? Each of these have different characteristics. They vary widely. And those might be the products and services that that business unit does or its location and the regulatory regime and geopolitical environment that lives within that location or their supply chain or their customers or their products and services, etc. All those things add together to drive a very different risk profile. So you talk in the article about imagining not only the threats, but also who your adversaries are. How do you do that sort of when what you're trying to do is keep up with criminals who are constantly trying to find new tools and strategies to get at you?

17:32Thomas Parenty:So I would say that the strategies that criminals or others use to attack you is one issue. And it is certainly relevant for cybersecurity staff to keep abreast of the latest techniques that cyber adversaries might use. However, in terms of identifying those cyber adversaries, that is something that is, for the most part, a very business-oriented activity that doesn't require technical knowledge. There are a couple of ways in which companies can start to address that issue, one of which is what do they have that would be of value to someone else? That could be the design of a product. It could be a collection of customers.

18:16Thomas Parenty:By identifying what a company has that could be of value, that's one way of looking at it. Another avenue that companies can take is, is there anything about the business that the company is in, the way in which it operates, that might attract some sort of attacker? With increasing discussions about climate change, companies that are viewed as carbon negative could attract this kind of attention. Or if there was a case in which a company was not or an organization was not being honest about certain of its business practices, that could invite a cyber attacker. And point of fact, that would be the situation that might.

19:00When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen and helps reach people with the right skills, certifications and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a$75 sponsored job credit at Indeed.com slash podcast. That's Indeed.com slash podcast. Terms and conditions apply. Need a hiring hero? This is a job for Indeed Sponsored Jobs. Propel Fitness Water with Gatorade electrolytes, zero sugar, and vitamins.

19:36Propel hydrates better than water to help you get the most out of your workout and get back to your best self. What propels you? Propel with Gatorade electrolytes.

19:45Thomas Parenty:Former employer NSA was in with respect to Edward Snowden. Depending on where a company operates, the adversaries it might face in one area could be very, very different from the adversaries they could face in another part of their business in another part of the world. Right. And I don't want to make it seem like you're advertising your business, but because these issues are so complicated and so different from function to function and company to company and geography to geography, do organizations need to bring in outside help and expertise? One of the things that we talk about in the book is the importance of building an internal capability to recognize what really, truly drives your cyber risk going forward.

20:34Thomas Parenty:And oftentimes those are changes in the way you do business because most of those new cyber risks come less from a new type of technical attack. It's actually that merger that you're about to go through or that new product that you're about to launch or that change to that internal application that you have. Those are all things that change the way that you're doing business. And those changes have implications as it relates to the risk that you face. So whether an attack is simple or sophisticated, are you saying that companies are able to prevent them if they take the right steps? In all areas of risk, whether it be financial risk, physical risk or cyber risk, there are no guarantees that what you do will be sufficient to fend off the attack that you actually face.

21:26Thomas Parenty:However, if you actually have focus on knowing what is important to protect, understanding the kinds of cyber attacks that could compromise critical activities, you are in a much, much better place to defend yourself properly than if you take more of a shotgun approach of, well, this is a general vulnerability. and so I'm going to buy a box that takes care of that. How frequently do leaders of a company or a function need to be reviewing and then revising what their plan is? It's an ongoing exercise, right? I mean, it's not a one-off thing. This is something that's dynamic. And to our point before in terms of where to look for cyber risks, where to anticipate them, it generally relates to changes that you're making to your business, whether it's a new product that you're launching, a new geography that you're getting into, a new supply chain partner that you're working with, all these point to changes in the way that you do business.

22:32Thomas Parenty:These introduce changes in technology because of the way that we work today. And those changes in the technology and the way you do business invite you to do new things with your business that drives new risks. Right. And so in some sense, the one answer is that companies need to incorporate into all of the processes used for making change some type of cybersecurity review. Now, this does not have to be and should not be a terribly onerous and time-consuming activity because, one, that will get in the way of doing business. And as we've discussed previously, people will find a way around it. But it is important to make sure that when companies are undertaking the changes that will introduce new cyber risk, that they are at least paying attention to that.

23:24Are there ways that companies should restructure themselves to make sure that people at every level and in every part of the organization are thinking about cybersecurity in a more careful way?