What trends will 2018 bring for Business Continuity Professionals?
•
1 like•790 views
Many business continuity practitioners are perceiving a higher level of risk than ever before in their careers. Unfortunately, these risks are more often resulting in real incidents which require emergency response and continuity of operations. Being prepared may be the most important thing an organization can do in 2018. But what should we prepare for, and how should we prepare for it? This discussion will walk through some of the emerging threats concepts, tools, and techniques that business continuity professionals can expect to see more of in 2018. Main points covered: - What should we prepare for in 2018? - How should we prepare? - The emerging threats, concepts, tools, and techniques expected in 2018 - Emerging threats creating new risks Presenter: David Feeney, CPP, PMP has 17 years of security industry experience assisting organizations with risk management matters specific to physical, personnel, and cyber security. He has 9 years of experience with service providers and 8 years of experience within enterprise security organizations. David has worked with industry leaders in the energy, technology, healthcare, and real estate sectors. Areas of specialization include Security Operations Center design and management, Security Systems design and implementation, and Enterprise Risk Management. David holds leadership positions in ASIS International and is also a member of the InfraGard FBI program. David holds Certification Protection Professional (CPP) and Project Management Professional (PMP) certifications. Andrea LeStarge, MS has over ten years of experience in program management, risk analysis and curriculum development. Being specialized in Homeland Security, Andrea leverages her experience in formerly managing projects to support various Federal Government entities in identifying, detecting and responding to man-made, natural and cyber incidents. She has an established track record in recognizing security gaps and corrective risk mitigation options, while effectively communicating findings to stakeholders, private sector owners and operators, and first-responder personnel within tactical, operational and strategic levels. Overall, Andrea encompasses analytical tradecraft and demonstrates consistent, repeatable and defensible methodologies pertaining to risk and the elements of threat, vulnerability and consequence. Organizer: Nevila Muka Date: January 17, 2018 Link to the recorded webinar:
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to What trends will 2018 bring for Business Continuity Professionals?
Similar to What trends will 2018 bring for Business Continuity Professionals? (20)
More from PECB
More from PECB (20)
Recently uploaded
Recently uploaded (20)
What trends will 2018 bring for Business Continuity Professionals?
- 1. What trends will 2018 likely bring for business continuity professionals?
- 2. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 2 Introductions David Feeney, CPP, PMP Andrea LeStarge, MS Advisory /Consulting Energy/Utilities Private Sector GSOC Security Operations Technology Advisory / Consulting National Lab Federal & State Gov’t Fusion Centers Risk Assessments Training
- 3. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 3 Baselining: Terminology 4 Looking deeper into likely trends: Who, what, how 5 Looking deeper into likely trends: New technologies 6 Looking deeper into likely trends: Cyber 7 Looking deeper into likely trends: Data breach 8-9 Looking deeper into likely trends: Internet of Things (IoT) 10-11 Looking deeper into likely trends: Physical 12 Impact on business continuity planning 13-15 Executive sponsorship, stakeholder buy-in 16 Top actions & questions for executives 17 Agenda
- 4. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 4 Baselining: Terminology Vulnerabilities Threats Business Continuity Risk Management
- 5. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 5 Looking deeper into likely trends: Who, what, how • Cyber criminals • Hacktivists (agenda driven) • Nation states • Insiders / partners • Competitors • Skilled individual hacker • Theft of intellectual property or strategic plans • Financial fraud • Reputation damage • Business disruption • Destruction of critical infrastructure • Threats to health & safety Who might attack? What are they after; What are the key business risks I need to mitigate? What tactics might they use? • Spear phishing, drive by download, etc. • Software or hardware vulnerabilities • Third-party compromise • Multi-channel attacks • Stolen credentials • … and others
- 6. Presentation title [To edit, click View > Slide Master > Slide Master] Member firms and DTTL: Insert appropriate copyright [To edit, click View > Slide Master > Slide Master] 6 The digital revolution is driving business innovation and growth, yet also exposing users to new and emerging threats. Exciting technological innovations bring fantastic opportunities: Driving down costs; Increasing integration; and Driving efficiencies. But opportunity brings risk: New avenues of exploitation mean businesses have a greater exposure to cyber attacks than ever before. Looking deeper into likely trends: New technology YOU The increasing prevalence of cyber attacks means that new techniques and tools are needed New Technology = New Threats
- 7. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 7 Looking deeper into likely trends: Cyber “63% of confirmed data breaches leverage a weak, default, or stolen password.” “30% of phishing emails are opened. And ~12% of targets go on to click the link or attachment.” “Crypto-style ransomware grew 35 percent in 2015.” “59% of employees steal proprietary corporate data when they quit or are fired.” “99% of computer users are vulnerable to exploit kits (software vulnerabilities).” BITSIGHT. 2018. 28 Data breach statistics that will inspire you (to protect yourself). Retrieved from: https://www.bitsighttech.com/blog/data-breach- statistics
- 8. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 8 Looking deeper into likely trends: Data breach “In 2016, there were 454 data breaches with nearly 12.7 million records exposed.” “In 93% of breaches, attackers take minutes or less to compromise systems.” “4 out of 5 victims of a breach don’t realize they’ve been attacked for a week or more.” “The forecast average loss for a breach of 1,000 records is between $52,000 and $87,000.” BITSIGHT. 2018. 28 Data breach statistics that will inspire you (to protect yourself). Retrieved from: https://www.bitsighttech.com/blog/data-breach- statistics
- 9. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 9 Looking deeper into likely trends: Data breach (Cont’d) Ponemon Institute, Cybersponse, 2018. Retrieved from: https://cybersponse.com/dont- be-a-statistic-these-numbers-are-scary $400B+ 50% 90% 63%8% 11% 18% Healthcare Financial Services Educational Government 229 99.9% 27.5%increase in the data breaches in various industries from 2013 15% o f i n c i d e n t s s t i l l t a k e d a y s t o d i s c o v e r Average number of days attackers maintained presence after infiltration and before detection chance that at least one person will fall prey to a phishing campaign with just 10 emails recipients open emails and click on phishing links within the first hour of receiving them $154 $201 $217 Global Average 2014 2015 Per capita cost of data breach was highest in US in 2015 $217 of the exploited vulnerabilities were compromised more than a year after CVE was published Numbers denote industry wise breakup of 2014 data breach incidents is the annual cost to the global economy from cybercrime o f i n c i d e n t s i n v o l v e a b u s e o f p r i v i l e g e d a c c e s s 55%
- 10. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 10 Looking deeper into likely trends: IoT “The number of connected devices is expected to grow from 15.4 billion in 2015 to 30.7 billion by 2020 and 75.4 billion by 2025.” “Global spending on IoT across all markets is expected to grow from $737 billion in 2016 to $1.29 trillion by 2020.” “In 2017, 60% of global manufacturers will use analytics data recorded from connected devices to analyze processes and identify optimization possibilities.” VisionCritical. 2018. 13 stunning stats on the Internet of Things. Retrieved from: https://www.visioncritical.com/internet-of-things- stats/
- 11. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 11 Looking deeper into likely trends: IoT (Cont’d) Enable security by default through unique, hard to crack default user names and passwords. User names and passwords for IoT devices supplied by the manufacturer are often never changed by the user and are easily cracked. Botnets operate by continuously scanning for IoT devices that are protected by known factory default user names and passwords. Strong security controls should be something the industrial consumer has to deliberately disable rather than deliberately enable Build the device using the most recent operating system that is technically viable and economically feasible. Many IoT devices use Linux operating systems, but may not use the most up-to-date operating system. Using the current operating system ensures that known vulnerabilities will have been mitigated Use hardware that incorporates security features to strengthen the protection and integrity of the device. For example, use computer chips that integrate security at the transistor level, embedded in the processor, and provide encryption and anonymity Design with system and operational disruption in mind. Understanding what consequences could flow from the failure of a device will enable developers, manufacturers, and service providers to make more informed risk-based security decisions. Where feasible, developers should build IoT devices to fail safely and securely, so that the failure does not lead to greater systemic disruption. 1 2 3 4 US DHS. 2016. Strategic Principles for Securing the IoT. Retrieved from: https://www.dhs.gov/sites/default/files/publications/Strategic_Princi ples_for_Securing_the_Internet_of_Things-2016-1115-FINAL....pdf
- 12. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 12 Looking deeper into likely trends: Physical It is important to understand the actual physical threats for specific organizations, and specifically for individual lines of business or support functions. Active Shooter Workplace Violence Improvised Explosive Devices Insider Threat Physical security is changing for many of our Nation’s critical infrastructure sectors and the need for assistance is growing at a tremendous rate. Companies are feeling the strain traditional risk mitigation measures place on human resources. Security officers that used to work 9-to-5 are being replaced with automated security measures that are 24/7 and provide enhanced security technologies. With these advanced technologies, company policies and procedures are in need of updating to account for the technology and mechanisms that are in place to protect against a wide variety of both internal and external threats. Strong BIA strategies help organizations have strong security management and corporate governance of the organization. With well planned and developed business continuity programs, liabilities, and costs can be reduced in numerous areas. Growing Need for Structural Safeguarding
- 13. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 13 Convergence(s) • Renaissance of physical & cyber convergence • Integrate business continuity into all organizational functions (not just IT). • Business continuity practitioners should engage asset owners as a trusted advisor Impact on business continuity planning Physical Threats Cyber Threats
- 14. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 14 Enterprise Security Risk Management (ESRM) Business continuity (BC) across the enterprise Asset owner is stakeholder BC is trusted advisor Impact on business continuity planning (Cont’d) ESRM Process Identify asset Identify risk Prioritize risk Plan for risk
- 15. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 15 Focus on resilience vs impenetrability Resilience: Having the ability to recover from and reduce the impact of cyber incidents Resilience accepts to some degree that mitigation strategies are not impenetrable Impact on business continuity planning (Cont’d)
- 16. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 16 Executive sponsorship, stakeholder buy-in Board & CEO Senior Management (COO, CAO, CRO) IT Leadership (CIO) IT Risk Leadership (CISO / CITRO) Tone at the top, establish senior management accountability and a Business Continuity (BC)-aware culture Define the organization’s risk appetite and be accountable for BC Program. Empower the extended leadership team. Lead (not delegate) in defining and executing the strategy to execute the BC Program. Establish an effective interaction model with cyber and physical branches. Define the right balance between threat-centric vs. compliance-centric programs. Be a business enabler, without shying away from the role of BC Program custodian. Line of Business Leaders Support integration of BC Program processes into business growth and development activities. Appoint line-of-business BC Program officers. Architecture & Engineering Infrastructure Application Development Security Operations IT DOMAINS Manage and report on risks Execute on strategy Other functions… GOVERNANCE Fully integrate BC into cyber and physical disciplines – design for Six Sigma, not quality control. Integrate current technologies and people processes to address the latest threats per the business impact analysis results.
- 17. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 17 Top actions and questions for executives • Put a senior executive at the helm. He or she must be able to lead in a crisis, and also guide the program and enlist collaboration across diverse functions. • Map threats to the business assets that matter. Set direction, purpose, and risk appetite for the program. Establish priorities, and ensure funding and resourcing. • Drive early “wins.” Establish momentum by focusing on pilot initiatives that measurably impact business success. Use these to plant the seeds of long- term cultural change. • Accelerate behavior change. Create active learning scenarios that instill awareness of the impact of daily activity on cyber risk. Embed cyber risk management goals into evaluation of Top 100 executives. • Trust but verify. Conduct monthly or quarterly reviews about key risks and risk metrics, and address roadblocks. Key actions you should own Key questions you should ask • Are we focused on the right things? Often said, but hard to execute. Understand how value is created in your organization, where your critical assets are, how they are vulnerable to key threats. Practice defense-in-depth. • Do we have the right talent? Quality over quantity. There is not enough talent to do everything in-house, so take a strategic approach to sourcing decisions. • Are we proactive or reactive? Retrofitting for security is very expensive. Build it upfront in your management processes, applications and infrastructure. • Are we incentivizing openness and collaboration? Build strong relationships with partners, law enforcement, regulators, and vendors. Foster internal cooperation across groups and functions, and ensure that people aren’t hiding risks to protect themselves. • Are we adapting to change? Policy reviews, assessments, and rehearsals of crisis response processes must be regularized to establish a culture of perpetual adaptation to the threat and risk landscape.
- 18. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the “Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms. Copyright © 2018 Deloitte Development LLC. All rights reserved. 36 USC 220506 This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation.
- 19. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 19 ISO 22301 Training Courses ISO 22301 Introduction 1 Day Course ISO 22301 Foundation 2 Days Course ISO 22301 Lead Implementer 5 Days Course ISO 22301 Lead Auditor 5 Days Course Exam and certification fees are included in the training price. https://pecb.com/iso-22301-training-courses www.pecb.com/events
- 20. What trends will 2018 likely bring for business continuity professionals?Copyright © 2018 Deloitte Development LLC. All rights reserved 20 THANK YOU ? www.deloitte.com https://www.linkedin.com/in/davidfeeney/ https://www.linkedin.com/in/andrea-lestarge- 1b64a7a9/
Editor's Notes
- {Dave will go first; Andrea second.} Hello everyone. My name is Andrea LeStarge. I am a Manager at Deloitte and I have been with the Firm for almost three years. Within the Firm, my specialty is to advise clients on cyber and physical risk components (and that encompasses threats, vulnerabilities, impacts, mitigation measures). I work primarily in the Energy sector. My secondary industry is the public sector where I advise clients on strategic and operational plans aimed at responding to significant cyber events. Prior to joining the Firm, I worked in the Federal and State landscape. I taught physical and cyber risk, how to conduct assessments, how to analyze and create / disseminate intelligence products, and other homeland security topics like suspicious activity reporting. I specifically entered into this landscape as an intelligence analyst and eventually grew to managing a statewide fusion center. Fusion centers were created in every state after the terrorist attacks on the world trade center in September 11, 2001. Fusion Centers are basically security operational centers that house several professionals from various Federal, State, local govts and critical infrastructure sectors – all focused on sharing information and investigating leads and possibly cases in an effort to protect the homeland. I’m excited to be with you for the next hour and look forward to your questions and comments.
- {Dave} Today’s presentation is titled “Trends;” specifically we’re concentrating on some of the threats that are trends within BC. Everything we’ll be talking about is, in our opinion, an emerging or persistent trend to BC. With that said, today’s topics will include (review) *Please note, throughout this presentation, we do refer to statistics centered on North America, and specifically the United States; we don’t anticipate that these numbers are far-off from other country’s experiences.
- {Andrea} So to begin, let’s level set on our terminology. As mentioned in my short recap of my bio, I’m really big on the methodology of analyzing risk. According to the US Department of Homeland Security – and let it be known that many public and private agencies also use this methodology – in order to truly calculate risk, one must analyze threats, vulnerabilities and consequences (or impacts). There is a laundry list of possible scenarios of concern. Threats can be either manmade, cyber-related or weather induced (i.e. natural disasters). Threats can be either purposeful or accidental. What threats we should really concentrate on are those that would be successful because of known vulnerabilities. Vulnerabilities are weaknesses in structure, processes or technologies. When a vulnerability enhances the adversary’s capability of deploying his/her intended threat, the likelihood of the threat is enhanced. Vulnerabilities are also inter-related with consequences or impact. One can prioritize the existing vulnerabilities with thinking about the consequences if the threat was successful – would it harm people? Would business processes be shut-down? Would there be a psychological effect? Consequences are often the hardest to calculate, but are often the element within the risk formula that keeps us up at night. Finally, there is also a benefit of looking through the lens as the bad guy. Psychologically speaking, adversaries often want the “biggest bang for the buck.” S/he is not going to deploy a threat that will not be successful because there are no weaknesses. Likewise, s/he is not going to deploy a threat that will not result in a large impact – in other words, the resulting impact better be worth the risk to the adversary of getting caught, arrested, or even harmed or killed. This all relates to the intent of the adversary. Overall, the intent of the adversary is correlated with the consequences. Now, I realize that the topic of today’s presentation is “2018 trends in Business Continuity.” Interestingly, the relationship between Risk Management and Business Continuity is under scrutiny so in actuality, this terminology slide / topic is perhaps the baselining trend of BC in 2018. The process of conducting Business Impact Analyses (or BIA) is not the same as Risk Management, but what we just discussed is important because you would not want to conduct a BIA on an unlikely Threat because of non-existing or less-prioritized Vulnerabilities or on threats that would result in little impact and therefore appeal to the adversary. In sum, though the words of “Business Continuity” and “Risk Management” are not synonymous, conducting a BIA is dependent upon a successful and appropriate risk assessment. With this said, BIAs should focus on RISKS that are RELEVANT.
- {Andrea} This next slide helps us dive deeper into the “who, what and how” of Adversaries and we’ve specifically concentrated on the cyber (versus physical) landscape. In the security community, there’s been talk for years about the need to focus more on “IT risk”, or to “align security with the business,” or to “measure the value of security.” Some organizations have done very well with this, but on the whole there is still a lot of confusion about how to make that happen – and we believe this is primarily because the ownership for cyber risk has remained primarily in the Tech sphere. While executives and – increasingly – Board members are very concerned to know what’s going on, the programs themselves have continued to be delegated to technology leaders. To manage IT security from a cyber RISK perspective, though, means that it has to be taken on as a business problem. In other words, BC must become an executive-driven program. Don’t take this as Dave and I stating executives must suddenly become cyber security experts. Instead, we suggest that executives need to lead the discussion about: Who might be motivated to attack us? – Intent of Adversary from the last slide What could REALLY hurt the business? – Prioritizing consequences = CIA Model. Confidentiality, Integrity and Accountability How much risk are we really willing to accept? – and give directives that shape the program *This is crucial – there has to be SOME acceptance of risk. Once these questions are answered, then the entire organization can rely on technologists to figure out what kinds of tactics adversaries might use, and how to guard against or monitor for those indicators. Also in lines with the Business Continuity program, the program itself needs to utilize several different disciplines. Different types of business risk will likely require weighting or prioritizing these areas differently. For some types you may rely more heavily on traditional or modernized security controls. On the other hand, there may be highly risk-sensitive parts of the business that will require extra investment in monitoring infrastructure, or assignment of threat intelligence teams to analyze indicators of compromise. Similarly, other parts of the business may require strong “resilience” components – these would be well-defined and rehearsed incident response plans, redundancy infrastructure and disaster recovery capabilities – or you may decide that cyber insurance is an important part of your recovery plan.
- {Andrea} Up to this point, we’ve stated the importance of analyzing threats, vulnerabilities and consequences. And we’ve also acknowledged the benefit of asking ourselves “who would harm us, what would they do to harm us and how would they harm us?” Honing in on the risk formula’s element of THREAT, we acknowledge that a persistent trend in business continuity for 2018 is the new technologies that we all face. What are those new technologies? Well, we’ve included some examples in the yellow dots – using cloud services or allowing employees to bring /use their own mobile device. Granted these innovations bring fantastic opportunities for us as business owners/operators – new technologies drive down costs, increase integration and drive efficiencies. But, we must acknowledge the risk that new technologies also bring. Technology could be the deployment mechanism of a threat actor and/or the vulnerabilities that Threat Actors could take advantage of to bring about negative impacts to our organizations. In other words, new technologies do bring new avenues of exploitation and as a result, organizations must acknowledge their potential increased exposure to cyber-attacks. So let’s fully transition to the threat of cyber – and Dave, I’ll hand the microphone over to you …
- {DAVE} Let’s take a look at some of the real-world cyber events… Data Breach Ransomware Phishing Data Loss/Insider Threat Vulnerability Mgmt. (“the basics”) Data loss / Insider Threat Highlights are about Threats and Vulnerabilities within the cyber landscape. It’s interesting that there is so much good attention paid to cyber risk mitigation efforts, but the lessons learned when a cyber incident occurs is often a very basic action could have prevented the attack from occurring in the first place. So, let’s not loose track of basics = spend the time on training and
- {Dave} We’ve heard it said, there are two types of organizations - those that have been breached and those that have been breached and don’t know it. Read stats.
- {Dave} It is obvious the need for Cyber Risk Services is growing. Attacks and breaches are more and more common and the methods of attack are ever-changing. Some notable statistics include 229 as the average number of days before an infiltration/breach is detected. And that the Healthcare industry has the most breaches by far at 63% of all breach incidents. SOURCE: Ponemon Institute, Cybersponse, 2018 https://cybersponse.com/dont-be-a-statistic-these-numbers-are-scary
- {Dave} Manufacturers of widgets not cyber experts.
- {Dave} Two sided- perspective: Manufacturer = Should ensure this; Purchaser = Should verify that these are in place and if not, that’s an accepted risk
- {Andrea} Solution! Training. Example = https://www.asisonline.org/About-ASIS/Who-We-Are/Whats-New/SiteAssets/Pages/Soft-Target-and-Active-Shooter-Resources/Appendix%20D.pdf
- {Andrea} In this slide we talk about the convergence of trends. First, we have the physical and cyber convergence. In the previous slides, we’ve separated cyber and physical trends, but in this slide we acknowledge the convergence of these trends. A great example is NERC’s 3 out of 14 Critical Infrastructure Protection Requirements. *Transition to Dave* {Dave talks about the second and the third examples of convergence}
- {Dave}
- {Andrea} BC professionals need to concentrate on the ENTIRE spectrum of planning: Resilience is after-boom. Resilience is a measure of “it happened – now what? Are you totally crippled or can you minimize impact and start the clock again, and soon?” Impenetrability is before-boom. Our PPT today acknowledges several trends where the threat is going to happen, it’s a matter of when. So, place your BC efforts into planning for emergency response AND impacts to business process(es). Many want to keep these two elements separate, but we can acknowledge that many words within this word bubble are synonymous with BC programs. ///////////////////// **Dave, I know it’s traumatic, but you had an experience in this topic, do you mind sharing with the team here? Incidents are becoming more critical – be quick and efficient in your response in order to best reduce the impact of the incident.
- {Dave} *Six Sigma at many organizations simply means a measure of quality that strives for near perfection
- {Andrea} Read slide