21st Annual e-Crime & Cybersecurity Congress
1st & 2nd March 2023 • Park Plaza Victoria, London, UK
As cyberspace becomes the arena for a new cold war, does cybersecurity practice need to change?
Too much focus on PID protection, not enough on cybersecurity?
Not that long ago cybersecurity was the art and science of stopping economically motivated actors exploiting vulnerabilities in traditional IT networks to commit a fairly narrow range of frauds, disruptions and data thefts. It was the counterpoint to cybercrime, which was seen as being carried out almost exclusively by non-state actors. Yes, some nation-states used cybercrime to make money and yes, governments’ use of cyberattacks for economic and political espionage is not new.
However, it’s become increasingly clear that a new global cyberwar has started that looks very much like the cold war of the 1950s to 1980s. As one commentator puts it, instead of stockpiles of nuclear weapons, “the threat of cyberwar, by contrast, has more to do with a global stockpile of vulnerabilities, amassed by accident as a by-product of continued innovations in connectivity. In the end, the sensation is the same: a foreboding feeling of pervasive, imminent risk. Cyberwar is real.”
So how does a cyber-cold war create a different set of risks for individual organisations? Does the potential for huge rises in the scale and sophistication of attacks, and the likelihood that infrastructure disruption and destruction will become more prevalent, objectively change the security calculus? One answer is that it will force firms to stop focusing narrowly on GDPR and think strategically about real security: as Mario Greco, chief executive at insurer Zurich says, focusing on the privacy risk to individuals is missing the bigger picture: “First off, there must be a perception that this is not just data . . . this is about civilisation. These people can severely disrupt our lives.”
The struggle to value cybersecurity
It’s hard to argue that cyberrisk is not rising. And most security professionals seem to agree that in some ill-defined way, it is.
- 51% of CISOs/CIOs, believe that businesses will need a specific strategy in place to protect against cyberwarfare in the next 12-18 months.
- The C-suite is increasingly concerned about loss of IP and R&D secrets, revenues and operational resilience.
- Governments are concerned about the potential for attacks on CNI and also for exploitation of poorly-understood linkages in financial systems, energy infrastructure and supply chains.
So surely the value of good cybersecurity, and of the professionals who implement it, is rising too? That’s not so easy to prove.
For a start, not everyone believes the new threats mean a new strategy is need. One piece of research showed that while 71% of CIOs and CISOs in a sample of almost 7,000 cybersecurity professionals believe cyberwarfare is a threat to their organization, 27% still admit to not having a strategy in place to mitigate this risk.
On the other hand, insurance premiums continue to spiral up as insurers get more data on how frequent attacks have become and how much damage they cause. Indeed, Zurich’s Greco says that cyberattacks will become uninsurable, particularly those involving state actors (Lloyds of London just announced an exemption for state attacks too). That struggle to assess the right premium level.
But generally, it has not got any easier to properly quantify cyberrisk at the firm level. So, Boards, while they put cyber at the top of their risk priorities, still do not put their money where their poll responses are.
This year’s e-Crime & Cybersecurity Congress will look at how we all need a new kind of security. Join our real-life case studies and in-depth technical sessions from the security and privacy teams at some of the world’s most admired brands.
