[Applause] this is my credit card and somebody I’m
this is my credit card and somebody I’m
this is my credit card and somebody I’m not letting you see the numbers of
not letting you see the numbers of
not letting you see the numbers of course somebody stole it
course somebody stole it
course somebody stole it and it’s it’s really frustrating because
and it’s it’s really frustrating because
and it’s it’s really frustrating because I never you know had it lying around I
I never you know had it lying around I
I never you know had it lying around I never lost possession of this physical
never lost possession of this physical
never lost possession of this physical card but as we all know all it takes
card but as we all know all it takes
card but as we all know all it takes these days right is for someone to get
these days right is for someone to get
these days right is for someone to get access to the credit card numbers and
access to the credit card numbers and
access to the credit card numbers and then they can go on a shopping spree and
then they can go on a shopping spree and
then they can go on a shopping spree and they went on a shopping spree has this
they went on a shopping spree has this
they went on a shopping spree has this happened to you know think okay I’m
happened to you know think okay I’m
happened to you know think okay I’m seeing I’m seeing that it has we’re not
seeing I’m seeing that it has we’re not
seeing I’m seeing that it has we’re not alone okay mine happened in 2014 and
alone okay mine happened in 2014 and
alone okay mine happened in 2014 and that year there were 17 million victims
that year there were 17 million victims
that year there were 17 million victims of identity theft in the US alone how
of identity theft in the US alone how
of identity theft in the US alone how about the letter have you received the
about the letter have you received the
about the letter have you received the letter saying that your personal
letter saying that your personal
letter saying that your personal information was part of a data breach
information was part of a data breach
information was part of a data breach and again I see you have that too I got
and again I see you have that too I got
and again I see you have that too I got that I got that too okay and these data
that I got that too okay and these data
that I got that too okay and these data breaches so in a data breach
breaches so in a data breach
breaches so in a data breach confidential and sensitive information
confidential and sensitive information
confidential and sensitive information is made available to an accessible that
is made available to an accessible that
is made available to an accessible that people who shouldn’t have access to it
people who shouldn’t have access to it
people who shouldn’t have access to it right and obviously these identity theft
right and obviously these identity theft
right and obviously these identity theft and data breaches are related because
and data breaches are related because
and data breaches are related because the data that’s being breached could
the data that’s being breached could
the data that’s being breached could easily be credit card numbers but it
easily be credit card numbers but it
easily be credit card numbers but it could also be social security numbers it
could also be social security numbers it
could also be social security numbers it could be health records it could be
could be health records it could be
could be health records it could be emails or it could be the blueprints for
emails or it could be the blueprints for
emails or it could be the blueprints for an advanced military fighter jet right
an advanced military fighter jet right
an advanced military fighter jet right and again we’re not alone gemalto is a
and again we’re not alone gemalto is a
and again we’re not alone gemalto is a company that studies this and in 2015
company that studies this and in 2015
company that studies this and in 2015 they reported that there were 700
they reported that there were 700
they reported that there were 700 million data records breached worldwide
million data records breached worldwide
million data records breached worldwide we hear news about data breaches it
we hear news about data breaches it
we hear news about data breaches it seems all the time and I think it’s
seems all the time and I think it’s
seems all the time and I think it’s lawless into a kind of sense of
lawless into a kind of sense of
lawless into a kind of sense of complacency about them you know so much
complacency about them you know so much
complacency about them you know so much so that they’re saying now is there are
so that they’re saying now is there are
so that they’re saying now is there are two kinds of organizations in the world
two kinds of organizations in the world
two kinds of organizations in the world those that have already had a data
those that have already had a data
those that have already had a data breach and those are will in the future
breach and those are will in the future
breach and those are will in the future and it there’s no question ok every
and it there’s no question ok every
and it there’s no question ok every every organization is vulnerable but
every organization is vulnerable but
every organization is vulnerable but when it gets to this point where it’s
when it gets to this point where it’s
when it gets to this point where it’s kind of a slogan ok it becomes a
kind of a slogan ok it becomes a
kind of a slogan ok it becomes a built-in excuse so the next time we have
built-in excuse so the next time we have
built-in excuse so the next time we have data breach a company will say we
data breach a company will say we
data breach a company will say we apologize for the data breach but you
apologize for the data breach but you
apologize for the data breach but you know what they say there’s two kinds of
know what they say there’s two kinds of
know what they say there’s two kinds of organizations in the world and you know
organizations in the world and you know
organizations in the world and you know so on and so so it conveys a sense of
so on and so so it conveys a sense of
so on and so so it conveys a sense of inevitability and hopelessness okay I
inevitability and hopelessness okay I
inevitability and hopelessness okay I don’t buy it for a second okay I’m not
don’t buy it for a second okay I’m not
don’t buy it for a second okay I’m not naive but I am impatient I work in this
naive but I am impatient I work in this
naive but I am impatient I work in this field okay it’s it’s not hopeless okay
field okay it’s it’s not hopeless okay
field okay it’s it’s not hopeless okay there are things we can do so I’m a
there are things we can do so I’m a
there are things we can do so I’m a computer scientist and professor in a
computer scientist and professor in a
computer scientist and professor in a business school at a university and I
business school at a university and I
business school at a university and I operate in these two worlds okay of
operate in these two worlds okay of
operate in these two worlds okay of Business and Technology so here’s what
Business and Technology so here’s what
Business and Technology so here’s what I’d like to do I’d like to explore these
I’d like to do I’d like to explore these
I’d like to do I’d like to explore these two worlds to see what can be done to
two worlds to see what can be done to
two worlds to see what can be done to reduce the frequency and impact of data
reduce the frequency and impact of data
reduce the frequency and impact of data breaches by exploring these two worlds
breaches by exploring these two worlds
breaches by exploring these two worlds and especially the territory between
and especially the territory between
and especially the territory between them when I work in these two worlds
them when I work in these two worlds
them when I work in these two worlds often it’s really quite distinct it’s
often it’s really quite distinct it’s
often it’s really quite distinct it’s like context switching it’s sort of like
like context switching it’s sort of like
like context switching it’s sort of like give lectures during the week and code
give lectures during the week and code
give lectures during the week and code on weekends and the two worlds you know
on weekends and the two worlds you know
on weekends and the two worlds you know they have their own characteristics I
they have their own characteristics I
they have their own characteristics I mean when you think of the business
mean when you think of the business
mean when you think of the business world it’s really about business matters
world it’s really about business matters
world it’s really about business matters okay the business world is about
okay the business world is about
okay the business world is about strategy and vision and mission and
strategy and vision and mission and
strategy and vision and mission and operations and costs and operations and
operations and costs and operations and
operations and costs and operations and more operations and revenues and profits
more operations and revenues and profits
more operations and revenues and profits and then there’s the cyber security
and then there’s the cyber security
and then there’s the cyber security technology world and when I think of
technology world and when I think of
technology world and when I think of that world you know what comes to mind
that world you know what comes to mind
that world you know what comes to mind is more like kind of a solitary coder
is more like kind of a solitary coder
is more like kind of a solitary coder and you know the kind of images there
and you know the kind of images there
and you know the kind of images there are more about like pocket protectors so
are more about like pocket protectors so
are more about like pocket protectors so I have I have my pocket protector okay
I have I have my pocket protector okay
I have I have my pocket protector okay and it’s more about like empty you know
and it’s more about like empty you know
and it’s more about like empty you know pizza boxes and so on so what I thought
pizza boxes and so on so what I thought
pizza boxes and so on so what I thought I’d do to kind of put these two worlds
I’d do to kind of put these two worlds
I’d do to kind of put these two worlds in stark contrast is come up with some
in stark contrast is come up with some
in stark contrast is come up with some images that try to capture the
images that try to capture the
images that try to capture the distinction between these two worlds so
distinction between these two worlds so
distinction between these two worlds so for the business world I get a chance to
for the business world I get a chance to
for the business world I get a chance to work with terrific business students I
work with terrific business students I
work with terrific business students I mean they’re ambitious and upbeat and
mean they’re ambitious and upbeat and
mean they’re ambitious and upbeat and positive and it’s all about
positive and it’s all about
positive and it’s all about collaboration and teamwork so here’s the
collaboration and teamwork so here’s the
collaboration and teamwork so here’s the image I’d like us to keep in mind for
image I’d like us to keep in mind for
image I’d like us to keep in mind for the world of business okay and to
the world of business okay and to
the world of business okay and to represent the technology world and
represent the technology world and
represent the technology world and that’s where cybersecurity is
that’s where cybersecurity is
that’s where cybersecurity is for that I think of sort of the iconic
for that I think of sort of the iconic
for that I think of sort of the iconic computer tech person the kind of techie
computer tech person the kind of techie
computer tech person the kind of techie you tolerate and for that I image from
you tolerate and for that I image from
you tolerate and for that I image from the film Jurassic Park
the film Jurassic Park
the film Jurassic Park okay the kind of iconic computer tech
okay the kind of iconic computer tech
okay the kind of iconic computer tech person so representing the technology
person so representing the technology
person so representing the technology world will be Dennis Nedry
so not only is he a tech person but
so not only is he a tech person but actually he’s a he’s a computer hacker
actually he’s a he’s a computer hacker
actually he’s a he’s a computer hacker in the film now today we’d call him a
in the film now today we’d call him a
in the film now today we’d call him a malicious insider okay so even his last
malicious insider okay so even his last
malicious insider okay so even his last name of this character Dennis Nedry I
name of this character Dennis Nedry I
name of this character Dennis Nedry I mean the last name Nedry is an anagram
mean the last name Nedry is an anagram
mean the last name Nedry is an anagram for nerdy so you know you see I had to I
for nerdy so you know you see I had to I
for nerdy so you know you see I had to I mean absolutely had to include him okay
mean absolutely had to include him okay
mean absolutely had to include him okay so we have these two images but what’s
so we have these two images but what’s
so we have these two images but what’s really going on in these worlds is also
really going on in these worlds is also
really going on in these worlds is also you know is also quite different and in
you know is also quite different and in
you know is also quite different and in the business world you know they’re
the business world you know they’re
the business world you know they’re concerned with operations and profits
concerned with operations and profits
concerned with operations and profits and revenues and so on but when there’s
and revenues and so on but when there’s
and revenues and so on but when there’s a data breach we think of that as being
a data breach we think of that as being
a data breach we think of that as being confined to the technology world so when
confined to the technology world so when
confined to the technology world so when something bad happens like a data breach
something bad happens like a data breach
something bad happens like a data breach I mean the worst that can happen
I mean the worst that can happen
I mean the worst that can happen okay would be maybe that well the chief
okay would be maybe that well the chief
okay would be maybe that well the chief information officer ok the CIO might get
information officer ok the CIO might get
information officer ok the CIO might get might get fired but then something
might get fired but then something
might get fired but then something happened okay in 2013 and that was the
happened okay in 2013 and that was the
happened okay in 2013 and that was the data breach at Target so retailers like
data breach at Target so retailers like
data breach at Target so retailers like Target I mean they’re looking for
Target I mean they’re looking for
Target I mean they’re looking for holiday shopping at the end of the year
holiday shopping at the end of the year
holiday shopping at the end of the year for a big boost in revenue okay and in
for a big boost in revenue okay and in
for a big boost in revenue okay and in the fourth quarter of 2013 profits at
the fourth quarter of 2013 profits at
the fourth quarter of 2013 profits at Target fell 46 percent so I’m talking
Target fell 46 percent so I’m talking
Target fell 46 percent so I’m talking about profits that’s something from the
about profits that’s something from the
about profits that’s something from the business side and 46 percent is a pretty
business side and 46 percent is a pretty
business side and 46 percent is a pretty big number so sure enough it was a data
big number so sure enough it was a data
big number so sure enough it was a data breach okay and the CIO did resign but
breach okay and the CIO did resign but
breach okay and the CIO did resign but we’re talking about profits so it turns
we’re talking about profits so it turns
we’re talking about profits so it turns out the CEO also left the company
out the CEO also left the company
out the CEO also left the company well when CEOs leave the company that
well when CEOs leave the company that
well when CEOs leave the company that tends to get the attention of other of
tends to get the attention of other of
tends to get the attention of other of other CEOs and right away in 2014 we had
other CEOs and right away in 2014 we had
other CEOs and right away in 2014 we had really massive data breaches at Home
really massive data breaches at Home
really massive data breaches at Home Depot eBay JP Morgan
Depot eBay JP Morgan
Depot eBay JP Morgan Chace federal government’s Office of
Chace federal government’s Office of
Chace federal government’s Office of Personnel Management and Sony
Personnel Management and Sony
Personnel Management and Sony Entertainment okay so I have one more
Entertainment okay so I have one more
Entertainment okay so I have one more image for you and it’s from the business
image for you and it’s from the business
image for you and it’s from the business side it’s company executives these are
side it’s company executives these are
side it’s company executives these are the executives at Sony Entertainment so
the executives at Sony Entertainment so
the executives at Sony Entertainment so the CEO is in the middle and here
the CEO is in the middle and here
the CEO is in the middle and here they’re apologizing for the PlayStation
they’re apologizing for the PlayStation
they’re apologizing for the PlayStation Network brief breach which affected 77
Network brief breach which affected 77
Network brief breach which affected 77 million accounts this image is riveting
million accounts this image is riveting
million accounts this image is riveting okay any thought that cybersecurity
okay any thought that cybersecurity
okay any thought that cybersecurity would keep its realm in the in the
would keep its realm in the in the
would keep its realm in the in the technology world is gone
technology world is gone
technology world is gone okay this image more than anything says
okay this image more than anything says
okay this image more than anything says that cybersecurity means business so how
that cybersecurity means business so how
that cybersecurity means business so how big a business issue is it for four
big a business issue is it for four
big a business issue is it for four companies two blocks from here is the
companies two blocks from here is the
companies two blocks from here is the Center for Strategic and International
Center for Strategic and International
Center for Strategic and International Studies they estimated the worldwide
Studies they estimated the worldwide
Studies they estimated the worldwide annual cost of cybercrime at over 445
annual cost of cybercrime at over 445
annual cost of cybercrime at over 445 billion dollars so here’s where we are
billion dollars so here’s where we are
billion dollars so here’s where we are in our exploration we’ve established
in our exploration we’ve established
in our exploration we’ve established that data breaches have a huge negative
that data breaches have a huge negative
that data breaches have a huge negative impact okay on people on companies and
impact okay on people on companies and
impact okay on people on companies and on the global economy so the question is
on the global economy so the question is
on the global economy so the question is what can we do about it one starting
what can we do about it one starting
what can we do about it one starting point may be to look at what does
point may be to look at what does
point may be to look at what does business know about cybersecurity how do
business know about cybersecurity how do
business know about cybersecurity how do they learn about it and there’s research
they learn about it and there’s research
they learn about it and there’s research from JP from PricewaterhouseCoopers it
from JP from PricewaterhouseCoopers it
from JP from PricewaterhouseCoopers it says boards of directors hear about
says boards of directors hear about
says boards of directors hear about cybersecurity 26% of them hear about it
cybersecurity 26% of them hear about it
cybersecurity 26% of them hear about it once a year and there’s another 28% that
once a year and there’s another 28% that
once a year and there’s another 28% that hear about it not at all so given we
hear about it not at all so given we
hear about it not at all so given we talked about what data breaches he’s
talked about what data breaches he’s
talked about what data breaches he’s hearing about cybersecurity once a year
hearing about cybersecurity once a year
hearing about cybersecurity once a year not at all really sufficient and when
not at all really sufficient and when
not at all really sufficient and when they do hear about cybersecurity what do
they do hear about cybersecurity what do
they do hear about cybersecurity what do we know that well it turns out that
we know that well it turns out that
we know that well it turns out that board members say it’s too technical
board members say it’s too technical
board members say it’s too technical okay they don’t understand the
okay they don’t understand the
okay they don’t understand the cybersecurity data or reports they want
cybersecurity data or reports they want
cybersecurity data or reports they want understandable language that doesn’t
understandable language that doesn’t
understandable language that doesn’t require them to be cybersecurity experts
require them to be cybersecurity experts
require them to be cybersecurity experts so here’s a way that here’s a way to
so here’s a way that here’s a way to
so here’s a way that here’s a way to proceed learn from this research okay
proceed learn from this research okay
proceed learn from this research okay and try to find more effective ways to
and try to find more effective ways to
and try to find more effective ways to deal with it it turns out there’s a
deal with it it turns out there’s a
deal with it it turns out there’s a window of
window of
window of opportunity because there is increased
opportunity because there is increased
opportunity because there is increased attention at the board level to risk and
attention at the board level to risk and
attention at the board level to risk and in fact sometimes it leads to dedicated
in fact sometimes it leads to dedicated
in fact sometimes it leads to dedicated risk committees some of this in the u.s.
risk committees some of this in the u.s.
risk committees some of this in the u.s. is mandated so for example a Georgia
is mandated so for example a Georgia
is mandated so for example a Georgia Tech study show that in 2008 8% of
Tech study show that in 2008 8% of
Tech study show that in 2008 8% of boards had dedicated risk committees and
boards had dedicated risk committees and
boards had dedicated risk committees and by 2015 53% of boards had risk
by 2015 53% of boards had risk
by 2015 53% of boards had risk committees so this is an opportunity now
committees so this is an opportunity now
committees so this is an opportunity now these risk committees they have a lot to
these risk committees they have a lot to
these risk committees they have a lot to consider okay they’re concerned with
consider okay they’re concerned with
consider okay they’re concerned with global economic conditions with
global economic conditions with
global economic conditions with reputational risk legal and regulatory
reputational risk legal and regulatory
reputational risk legal and regulatory compliance financial risks market risk
compliance financial risks market risk
compliance financial risks market risk liquidity risk credit risk and
liquidity risk credit risk and
liquidity risk credit risk and increasingly cybersecurity is on the
increasingly cybersecurity is on the
increasingly cybersecurity is on the list but cybersecurity stands out it’s
list but cybersecurity stands out it’s
list but cybersecurity stands out it’s still tied to specialized technical
still tied to specialized technical
still tied to specialized technical information and it’s really not of the
information and it’s really not of the
information and it’s really not of the same kind so here’s a recommendation
same kind so here’s a recommendation
same kind so here’s a recommendation recast cybersecurity it’s digital risk
recast cybersecurity it’s digital risk
recast cybersecurity it’s digital risk and I say this not out of a sense of
and I say this not out of a sense of
and I say this not out of a sense of euphemism or a simple name change it
euphemism or a simple name change it
euphemism or a simple name change it actually really gets at the origin and
actually really gets at the origin and
actually really gets at the origin and essence of this entire field
essence of this entire field
essence of this entire field cybersecurity is evocative of looking
cybersecurity is evocative of looking
cybersecurity is evocative of looking outward okay to online communication and
outward okay to online communication and
outward okay to online communication and the Internet cybersecurity is about
the Internet cybersecurity is about
the Internet cybersecurity is about security and cyberspace William Gibson a
security and cyberspace William Gibson a
security and cyberspace William Gibson a brilliant science fiction writer coined
brilliant science fiction writer coined
brilliant science fiction writer coined the term cyberspace in the 1980s he was
the term cyberspace in the 1980s he was
the term cyberspace in the 1980s he was inspired by seeing kids play those early
inspired by seeing kids play those early
inspired by seeing kids play those early arcade video games so energetically that
arcade video games so energetically that
arcade video games so energetically that as Gibson said it was as if they wanted
as Gibson said it was as if they wanted
as Gibson said it was as if they wanted to reach right through the screen to the
to reach right through the screen to the
to reach right through the screen to the space beyond cyberspace this is a realm
space beyond cyberspace this is a realm
space beyond cyberspace this is a realm of virtual experience created by the
of virtual experience created by the
of virtual experience created by the internet and public and private networks
internet and public and private networks
internet and public and private networks and all the words after cyber these days
and all the words after cyber these days
and all the words after cyber these days are evocative of this orientation to
are evocative of this orientation to
are evocative of this orientation to external networks so cyber monday is
external networks so cyber monday is
external networks so cyber monday is about online shopping and increasingly
about online shopping and increasingly
about online shopping and increasingly these days the word after cyber are
these days the word after cyber are
these days the word after cyber are around a theme like cyber rattling and
around a theme like cyber rattling and
around a theme like cyber rattling and cyber threat and cyber attack but in all
cyber threat and cyber attack but in all
cyber threat and cyber attack but in all cases oriented it’s an external networks
cases oriented it’s an external networks
cases oriented it’s an external networks but what does it research say about this
but what does it research say about this
but what does it research say about this if we go back to the
if we go back to the
if we go back to the 700 million data records that were
700 million data records that were
700 million data records that were breached it turns out 37 percent of them
breached it turns out 37 percent of them
breached it turns out 37 percent of them were because of accidents okay so it’s
were because of accidents okay so it’s
were because of accidents okay so it’s not intentional not a cyberattack
not intentional not a cyberattack
not intentional not a cyberattack nobody hacked anybody else I’m talking
nobody hacked anybody else I’m talking
nobody hacked anybody else I’m talking about human error its employees not
about human error its employees not
about human error its employees not following policies and procedures lack
following policies and procedures lack
following policies and procedures lack of expertise interacting with websites
of expertise interacting with websites
of expertise interacting with websites and applications and this is not about
and applications and this is not about
and applications and this is not about blaming employees it is about
blaming employees it is about
blaming employees it is about recognizing a need for companies to get
recognizing a need for companies to get
recognizing a need for companies to get greater employee engagement so these
greater employee engagement so these
greater employee engagement so these policies are realistic and it is about
policies are realistic and it is about
policies are realistic and it is about more training more education and more
more training more education and more
more training more education and more redesign of interfaces and software
redesign of interfaces and software
redesign of interfaces and software applications so that’s what’s really
applications so that’s what’s really
applications so that’s what’s really needed here’s a specific example last
needed here’s a specific example last
needed here’s a specific example last year a clinic in London used email to
year a clinic in London used email to
year a clinic in London used email to send out a newsletter and this
send out a newsletter and this
send out a newsletter and this newsletter goes to subscribers of a
newsletter goes to subscribers of a
newsletter goes to subscribers of a service where HIV patients can get their
service where HIV patients can get their
service where HIV patients can get their test results and the individual
test results and the individual
test results and the individual composing the email placed all 781 email
composing the email placed all 781 email
composing the email placed all 781 email addresses not in the BCC field but in
addresses not in the BCC field but in
addresses not in the BCC field but in the to field so this meant that every
the to field so this meant that every
the to field so this meant that every recipient of the email could see the
recipient of the email could see the
recipient of the email could see the email addresses of all of the other HIV
email addresses of all of the other HIV
email addresses of all of the other HIV patients and in most cases the full
patients and in most cases the full
patients and in most cases the full names as well so yes there is terrorism
names as well so yes there is terrorism
names as well so yes there is terrorism but there’s also error ISM okay in
but there’s also error ISM okay in
but there’s also error ISM okay in digital risk does a better job of being
digital risk does a better job of being
digital risk does a better job of being more comprehensive about it
more comprehensive about it
more comprehensive about it companies may not suffer losses from
companies may not suffer losses from
companies may not suffer losses from cyber attacks every day but I guarantee
cyber attacks every day but I guarantee
cyber attacks every day but I guarantee you every day
you every day
you every day employees are sending and storing and
employees are sending and storing and
employees are sending and storing and processing data and it’s all this
processing data and it’s all this
processing data and it’s all this digital data that can be breached with
digital data that can be breached with
digital data that can be breached with this balance of attention both
this balance of attention both
this balance of attention both internally and externally
internally and externally
internally and externally digital risk is ism is a much better
digital risk is ism is a much better
digital risk is ism is a much better term it’s really echoing strategy from
term it’s really echoing strategy from
term it’s really echoing strategy from 2,500 years ago in the art of war if you
2,500 years ago in the art of war if you
2,500 years ago in the art of war if you know the enemy and know yourself you
know the enemy and know yourself you
know the enemy and know yourself you need not fear the results of a hundred
need not fear the results of a hundred
need not fear the results of a hundred battles the current cyber security
battles the current cyber security
battles the current cyber security climate is oriented to knowing the enemy
climate is oriented to knowing the enemy
climate is oriented to knowing the enemy external threats and they are severe
external threats and they are severe
external threats and they are severe there’s no question about it
there’s no question about it
there’s no question about it but digital risk gives much better and
but digital risk gives much better and
but digital risk gives much better and much needed attention internally knowing
much needed attention internally knowing
much needed attention internally knowing yourself
yourself
yourself as a company digital risk is the right
as a company digital risk is the right
as a company digital risk is the right term at the right time it’s more
term at the right time it’s more
term at the right time it’s more indicative okay of all sources of risk
indicative okay of all sources of risk
indicative okay of all sources of risk especially what the research is telling
especially what the research is telling
especially what the research is telling us about the actual causes of data
us about the actual causes of data
us about the actual causes of data breaches but what else can we do Pro
breaches but what else can we do Pro
breaches but what else can we do Pro tivities a company that that looked at
tivities a company that that looked at
tivities a company that that looked at this and one approach might be to say
this and one approach might be to say
this and one approach might be to say what’s going on as far as best practices
what’s going on as far as best practices
what’s going on as far as best practices are what are the good companies or
are what are the good companies or
are what are the good companies or really top performers in cybersecurity
really top performers in cybersecurity
really top performers in cybersecurity doing and maybe all the companies can
doing and maybe all the companies can
doing and maybe all the companies can can copy that and what they found was
can copy that and what they found was
can copy that and what they found was the top performers in IT security and
the top performers in IT security and
the top performers in IT security and privacy had these characteristics in
privacy had these characteristics in
privacy had these characteristics in common they had the right tone from the
common they had the right tone from the
common they had the right tone from the top of the organization they had their
top of the organization they had their
top of the organization they had their core security policies in place and they
core security policies in place and they
core security policies in place and they had a data PLASA fication scheme so they
had a data PLASA fication scheme so they
had a data PLASA fication scheme so they understood what we call the crown jewels
understood what we call the crown jewels
understood what we call the crown jewels in their data so I’m looking at this
in their data so I’m looking at this
in their data so I’m looking at this list and I’m wondering where is the
list and I’m wondering where is the
list and I’m wondering where is the technology okay I don’t see anything
technology okay I don’t see anything
technology okay I don’t see anything about the top performers in security are
about the top performers in security are
about the top performers in security are top performers because they have an
top performers because they have an
top performers because they have an innovative computer network architecture
innovative computer network architecture
innovative computer network architecture I don’t see anything about them being
I don’t see anything about them being
I don’t see anything about them being top performance because they use a
top performance because they use a
top performance because they use a particular vendors intrusion detection
particular vendors intrusion detection
particular vendors intrusion detection and prevention system there’s no
and prevention system there’s no
and prevention system there’s no technology at all what I do see instead
technology at all what I do see instead
technology at all what I do see instead is business okay what makes top
is business okay what makes top
is business okay what makes top performers top performers is they have
performers top performers is they have
performers top performers is they have strong leadership from the top they have
strong leadership from the top they have
strong leadership from the top they have effective management practices and they
effective management practices and they
effective management practices and they understand what business they’re in they
understand what business they’re in they
understand what business they’re in they know their critical data and they
know their critical data and they
know their critical data and they understand their mission so this is a
understand their mission so this is a
understand their mission so this is a twist okay we started out wondering how
twist okay we started out wondering how
twist okay we started out wondering how the business world can learn more about
the business world can learn more about
the business world can learn more about cybersecurity
cybersecurity
cybersecurity it turns out one of the best ways to
it turns out one of the best ways to
it turns out one of the best ways to make an impact on data breaches maybe
make an impact on data breaches maybe
make an impact on data breaches maybe for the cybersecurity world to learn
for the cybersecurity world to learn
for the cybersecurity world to learn more about business okay so I really
more about business okay so I really
more about business okay so I really reached the reach of the end in our
reached the reach of the end in our
reached the reach of the end in our short journey and short exploration of
short journey and short exploration of
short journey and short exploration of these two worlds and and the territory
these two worlds and and the territory
these two worlds and and the territory between them so I’d like to just take a
between them so I’d like to just take a
between them so I’d like to just take a moment more to highlight what we’ve seen
moment more to highlight what we’ve seen
moment more to highlight what we’ve seen along the way here’s the future that I’d
along the way here’s the future that I’d
along the way here’s the future that I’d like for us okay when you’re holding
like for us okay when you’re holding
like for us okay when you’re holding your credit card in your hand then you
your credit card in your hand then you
your credit card in your hand then you can be confident that no-one’s stolen
can be confident that no-one’s stolen
can be confident that no-one’s stolen the credit card numbers
the credit card numbers
the credit card numbers and when you’re in a room like this and
and when you’re in a room like this and
and when you’re in a room like this and a speaker says I like all those who are
a speaker says I like all those who are
a speaker says I like all those who are victims of identity theft and data
victims of identity theft and data
victims of identity theft and data breach – raise your hand no hands will
breach – raise your hand no hands will
breach – raise your hand no hands will go up but I know that’s not our current
go up but I know that’s not our current
go up but I know that’s not our current reality okay but I know also it’s not
reality okay but I know also it’s not
reality okay but I know also it’s not it’s not hopeless and if we listen to
it’s not hopeless and if we listen to
it’s not hopeless and if we listen to the research in this cyber security
the research in this cyber security
the research in this cyber security business interface we can move these
business interface we can move these
business interface we can move these worlds of Business and Technology closer
worlds of Business and Technology closer
worlds of Business and Technology closer together we can recast cybersecurity is
together we can recast cybersecurity is
together we can recast cybersecurity is digital risk and we can apply strong
digital risk and we can apply strong
digital risk and we can apply strong leadership and effective management to
leadership and effective management to
leadership and effective management to reduce the causes of human error and as
reduce the causes of human error and as
reduce the causes of human error and as these two worlds come together it’s
these two worlds come together it’s
these two worlds come together it’s going to cause us to rethink those
going to cause us to rethink those
going to cause us to rethink those images we used at the beginning and they
images we used at the beginning and they
images we used at the beginning and they are moving closer together as well so
are moving closer together as well so
are moving closer together as well so when we think of the business world it’s
when we think of the business world it’s
when we think of the business world it’s still going to be an upbeat business
still going to be an upbeat business
still going to be an upbeat business professional but now it’ll be a cyber
professional but now it’ll be a cyber
professional but now it’ll be a cyber savvy professional who really
savvy professional who really
savvy professional who really understands digital risk and for the
understands digital risk and for the
understands digital risk and for the technology side representing this
technology side representing this
technology side representing this technology side we still have our iconic
technology side we still have our iconic
technology side we still have our iconic computer hacker character but now he’s
computer hacker character but now he’s
computer hacker character but now he’s all dressed up and ready for business
all dressed up and ready for business
all dressed up and ready for business okay thank you
okay thank you
okay thank you [Applause]
”
Be First to Comment