In July 2017, BT and KPMG published a joint report called “The Cyber Security Journey – From Denial to Opportunity”. It came out soon after the WannaCry and Petya ransomware attacks. The report warned businesses not to fall into dangerous traps while trying to secure a digital enterprise. At one end of its maturity scale were the “Denial” and “Worry” stages. At the other end were “False Confidence” and “Hard Lessons”.
Mark Hughes, then chief executive of BT Security, and David Ferbrache, then technical director in KPMG’s cyber security practice, gave the same message. Buying security technology in a hurry was no answer. Basic cyber hygiene, a security culture and board-level ownership mattered more.
Five stages of security maturity
BT and KPMG described five stages that organisations go through. The first was Denial, the belief that an attack would not happen to them. Next came Worry, when the urge was to buy as much security as possible. Then came False Confidence, the belief that the organisation was ready. The fourth stage in the 2017 report was Hard Lessons. The last stage was “true leadership” in cyber security. The report said organisations met different challenges at each stage.
The report treated firewalls and antivirus software as essential “good housekeeping” at the start of the journey. But it warned against throwing money at security products as a knee-jerk reaction. This applied most to firms that had moved from Denial into constant Worry. Firms at that stage tended to see the newest technology as a silver bullet. In 2017 the authors said this made those companies targets for cyber criminals and also for over-eager IT salespeople.
Basics before purchases
The report’s first step was for businesses to check their current controls against industry best practice. In Singapore, it pointed to guidance and resources from the Cyber Security Agency of Singapore. The aim was to find gaps and decide which areas to fix first. It also said everyone in an organisation, starting with the board, was responsible for high standards of cyber hygiene. Training and awareness were meant to turn staff from the weakest link in the security chain into an asset.
Hughes said in 2017 that the ransomware outbreaks showed how fast even simple attacks could spread around the world. He also said many organisations could have avoided these attacks by maintaining better standards of cyber hygiene and getting the basics right. In his view, every business needed to manage the security of its IT systems, people and processes, from sole traders and SMEs to multinationals.
Ferbrache argued that the run of attacks had kept cyber risk high on the business agenda and was driving new investment. He warned against hasty reactions and said security was a journey with no single answer for everyone. He named patching and back-ups as basics that had to be done well. He also said security should help the business rather than block it. He described attackers as ruthless criminal entrepreneurs. The response he called for was a community effort as the boundaries between businesses disappeared, not jargon-filled technology. He said future chief information security officers would need to care about digital risk, help the business take up opportunities and build cyber resilience.
Ferbrache also warned that companies can spend a lot of money and not actually secure what is valuable to them.
Boards, complexity and partners
The report said cyber security was now discussed more often at board level, but those discussions were too infrequent and were treated as a separate issue, disconnected from broader operational risk. It found that security was often left out of overall business strategy. Research for the report also found a gap in digital transformation. Hughes said 68% of the CEOs surveyed did not see security as part of their digital transformation processes.
The authors also said that overly complex IT architecture could widen security gaps. This was especially true when the technology was hard to use or poorly integrated.
To reach true leadership, the report called on firms to focus on good governance, integrate their technologies properly and consider outsourcing some less critical parts of their security to a trusted partner. It also recommended sharing threat intelligence, good practice and hard-won lessons with peers. It said this would help boards treat security as a business opportunity and an enabler of digital transformation, not as a risk discussed perhaps twice a year.
Both companies had a commercial interest in the topic. KPMG offered security strategy consultancy, and BT sold security services built on its own network security capabilities. Dark Reading still judged the report useful and said it did not read like a sales pitch.
Then and now
The report’s focus on people stayed in use after 2017. Security awareness company Proofpoint later used the BT/KPMG whitepaper, under the title “Securing the digital enterprise”, as a guide for managing risk from end users. Proofpoint drew on the report’s advice to first work out which stage an organisation was at, and then to go beyond technology. It also highlighted the report’s call for chief executives and board members to champion cyber security and, in the report’s words, “walk the talk”.
The full report was available to download from BT Global Services when it came out in 2017.