Published on 29/11/2016 in News
The huge turnout for the Proximus Cyber Security Convention proved it once again: security is attracting more and more attention. And rightly so. Various incidents have occurred over the past few months that have made the vulnerability of the connected world painfully obvious. Visitors to the Cyber Security Convention heard, among other things, about how the motives and techniques of cyber criminals are evolving. In addition, a wide-ranging programme of workshops gave them the chance to learn more about how companies can arm themselves against the risks.
“Often the CEO asks the wrong question to the CSO,” said Paul King, UK CSO (Chief Security Officer) at Cisco Systems UK. “The CEO should not ask whether they are secure, but should ask the CSO if they are happy with the level of risk to the business”. The CEO must understand the level of risk that the business is accepting because if something goes wrong, the CEO is responsible and they will have to explain what happened to the press, the customers, the regulators and the shareholders. In his presentation, Paul King explained how Cisco has excellent security visibility by using the network as a sensor for detecting and protecting against cyber attacks. While this covers 95% of the threats, there is an additional team that focuses on threat intelligence to address so-called Advanced Persistent Threats (APT). “This is where the greatest danger lies today,” according to Paul King, “because a lot of companies don’t even realise that criminals have made their way in.”
Financial and administrative institutions are often potential targets of cybercriminals. The European Union protects its institutions with a security team of thirty employees. “Everything is connected today,” says Freddy Dezeure, head of CERT-EU, “and so everything is vulnerable.” He sees a development in cybercriminals’ motives. “It goes further than stealing money, espionage or political activism. We see actions that are aimed at disrupting the whole of society, for instance by paralyzing the financial system or the energy supply facilities.” So Freddy Dezeure argues in favor of more cooperation, not just between business and IT, but also between businesses and institutions. “Cyber risks have to be included in the general business risk processes.”
The link between business and IT also came clearly to the fore in a debate with four CISOs: Frédéric Ruelle (Federal Public Department of Foreign Affairs), Ian West (NATO NCI Agency), Kris Hallaert (Elia) and Stefan Van Gansbeke (CM-MC). The general opinion was that CISOs have to find their place in the organization as the link between the business and the security experts. What is more, CISOs have to adopt a position independent of the CIO. Fabrice Clément, CISO at Proximus, pointed out that people are not the weakest element, but precisely the most important link in the story.
“You have to think like the bad guys,” explained Olivier Ménil, Business Development Manager Security at Proximus, “to be able to anticipate as well as possible.”