Sean Peasley, Partner, Deloitte Risk and Financial Advisory, Global and US Cyber IoT Leader Deloitte & Touche LLP and Robert M Lee, Dragos CEO discuss of what it takes to succeed in mitigating risk in industrial environments. Includes: - - Deloitte's "Future of Cyber" survey that indicates many firms are not positioned to succeed at mitigating cybersecurity risks - Key findings and relevant strategies from survey to address risks - Executive insights from Dragos CEO briefing boards of directors on how to assess risk and where to prioritize resources in industrial control systems - How to improve risk visibility and defenses for OT security More Info: Dragos 2018 Year in Review: https://dragos.com/year-in-review/ Deloitte Future of Cyber Survey: https://www2.deloitte.com/us/en/pages/advisory/articles/future-of-cyber-survey.html Twitter: https://twitter.com/dragosinc LinkedIn: https://www.linkedin.com/company/drag...

1. Future of Cyber
March 28, 2019

2. Future of Cyber

3. Copyright © 2019 Deloitte Development LLC. All rights reserved. 3
Cyber and the challenge of digital transformation
Top ranked cyber transformation initiatives for the next 12 months
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber

4. Copyright © 2019 Deloitte Development LLC. All rights reserved. 4
Most challenging aspects of cybersecurity management across enterprise infrastructure
Cyber and the challenge of digital transformation
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber
Chief
Information Security
Officers
Chief
Technology
Officers
Chief
Risk
Officers
Chief
Security
Officers
Chief
Information
Officers

5. Copyright © 2019 Deloitte Development LLC. All rights reserved. 5
Organizations’ cyber budget is somewhat evenly
spread to broadly protect them from risks
How cybersecurity organizations spend their $$$
Percentage of cyber budget allocated
to digital transformation
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber

6. Copyright © 2019 Deloitte Development LLC. All rights reserved. 6
Most challenging aspects of cybersecurity
management across the organization
The enterprise challenges of cybersecurity management
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber

7. Copyright © 2019 Deloitte Development LLC. All rights reserved. 7
Frequency cybersecurity issues are on the board’s agenda
Cyber needs leaders with the authority to drive change
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber
Chief
Information Security
Officers
Chief
Technology
Officers
Chief
Risk
Officers
Chief
Security
Officers
Chief
Information
Officers

8. Copyright © 2019 Deloitte Development LLC. All rights reserved. 8
It takes a village: creating a cyber team
Outsourced cybersecurity operations
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber
Chief
Information Security
Officers
Chief
Technology
Officers
Chief
Risk
Officers
Chief
Security
Officers
Chief
Information
Officers

9. Copyright © 2019 Deloitte Development LLC. All rights reserved. 9
Cybersecurity functions outsources to third parties
It takes a village: creating a cyber team
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber

10. Copyright © 2019 Deloitte Development LLC. All rights reserved. 10
Strategizing for perpetual resilience
Timing of most recent cyber incident
or breach among total participants
Biggest impacts of cyber incidents or
breaches on organizations
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber

11. Copyright © 2019 Deloitte Development LLC. All rights reserved. 11
Strategizing for perpetual resilience
Methods for reviewing and testing cyber incident response process and procedures
Source: The future of cyber survey 2019 | Cyber everywhere. Succeed anywhere. Deloitte
Development LLC. See www2.deloitte.com/us/cyber
Chief Information
Security Officers
Chief Technology
Officers
Chief Risk
Officers
Chief Information
Officers
Chief Security
Officers

12. Enterprises in the Era of Cyber Everywhere
Information Technology Operational Technology
Innovation

13. ICS YIR 2018: Threat Activity Groups
New ActivityNew Activity Group

14. Copyright © 2017 Deloitte Development LLC. All rights reserved. 14
Key Considerations for
Executives
• How do we know if we’re
underspending or
overspending on ICS
cybersecurity?
• What is the best thing we can
do to get started that will help
move us forward?
• If a major attack happens,
what is the role of the
government?

15. Copyright © 2017 Deloitte Development LLC. All rights reserved. 15
Are We
Underspending or
Overspending?

16. Copyright © 2017 Deloitte Development LLC. All rights reserved. 16
• Organizations are
underspending on
industrial/OT
cybersecurity, because it
has largely not been
considered part of the
overarching
cybersecurity strategy
Are We
Underspending or
Overspending?

17. What is the best way
to move forward?

18. What is the best way
to move forward?
• Boards should ask
security teams to
create tabletop
exercises that
include them at
some point

19. Copyright © 2017 Deloitte Development LLC. All rights reserved. 19
What is the role of
the government?

20. Copyright © 2017 Deloitte Development LLC. All rights reserved. 20
What is the role of
the government?
• Government agencies
play certain roles, but
boards should have
points of contact at each
government agency and
ensure written
communication

21. Key recommendations for industrial organizations
1. Ensure investment into industrial and operations networks are
appropriate for risks
2. Understand the threat landscape
3. Seek top to bottom understanding of requirements
4. Utilize threat hunting and tabletop exercises to bring together
security and operations teams
5. Don’t expect enterprise security teams to cover missions
without adding new resources for them

22. Executive Insights Into Industrial Cybersecurity Strategies
Dragos 2018 Year in Review
https://dragos.com/year-in-review/

23. Copyright © 2019 Deloitte Development LLC. All rights reserved.
What does the future hold?
The future of cyber survey 2019
Cyber everywhere. Succeed anywhere.
www.deloitte.com/us/cyber
Executive insights

24. About Deloitte
This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a
substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should
consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation.
As used in this presentation, “Deloitte” means Deloitte & Touche LLP, a subsidiary of Deloitte LLP. Please see www.deloitte.com/us/about for a detailed description of our legal structure. Certain services may not be available to attest
clients under the rules and regulations of public accounting.
Copyright © 2019 Deloitte Development LLC. All rights reserved.