The State of Cybersecurity and Digital Trust 2016

Architecting the As-a-Service Economy
Delivering Cybersecurity & Digital Trust
An HfS Webinar Production, 20 July 2016
FRED MCCLIMANS
HfS Research
CHRISTINE FERRUSI ROSS
HfS Research
STEVEN CURTIS
Accenture
RYAN LASALLE
Accenture

© 2016 HfS Research Ltd. Proprietary │Page 2
Agenda
• The State of Cybersecurity and
Digital Trust: An Overview
• Discussion
• Q&A/Closing

To better understand the State of Cybersecurity & Digital Trust
HfS and Accenture spoke with 208 enterprise professionals, providing operational
cybersecurity or security oversight, across multiple geographies and vertical industries.
We learned a lot.
Source: "State of Cyber Security 2016", HfS Research and Accenture
Sample: Enterprise Security Professionals = 208
61
52
30
11
22
32
North America
Europe
Asia Pacific including Australia/NZ
Middle East and Africa
Latin America
India
# Respondents by Region
46
88
51
23
500 - 999
1,000 – 4,999
5,000 – 49,999
50,000+
# Respondents by Enterprise Size
31
33
30
20
25
36
33
Media & Technology (includes telecoms, software, …
Banking & Financial Services (includes capital markets, …
Resources (includes energy, utilities, transportation, etc.)
Healthcare / Pharma
Public Sector / Government / NGO
Products (includes manufacturing, distribution, retail, …
Other / Not listed
# Respondents by Vertical Industry

What are the “Very/Critically Important” Goals and Initiatives?
28%
27%
29%
37%
14%
16%
14%
13%
0% 20% 40% 60%
Mobile
Cloud Storage
Culture of Cyber Security Awareness
Cloud Computing
How important are the following initiatives to your overall business?
(Very or Critically Important responses only)
VERY IMPORTANT
CRITICALLY
IMPORTANT
39%
47%
30%
39%
30%
26%
43%
37%
0% 20% 40% 60% 80% 100%
Marketing
Digital Transformation Agendas
Brand Reputation
Customer Support/Service
How important to the following business goals is your ability to properly secure your data?
VERY IMPORTANT
CRITICALLY
IMPORTANT

What are the initiatives that are placing the enterprise at risk?
Digital Identity Management and Mobile Payments are considered the top “risky activities”
when it comes to securing data – these are the potential disruptors of Digital Trust!
35%
39%
39%
42%
41%
23%
23%
23%
23%
28%
0% 10% 20% 30% 40% 50% 60% 70% 80%
Adoption of Mobile Apps
Shift to the cloud
Pervasive IoT Ecosystem Development
Adoption of Mobile Payments
Digital Identity Management
What impact are the following trends and/or initiatives having on business resilience and your ability
to properly secure your data?
(Strong or Critical Impact responses only)
STRONG IMPACT CRITICAL IMPACT

Where are today’s threats coming from?
They come from both internal and external threat actors!
69% 57%55%
80%
0%
100%
Internal External
Have you experienced the theft or corruption of internal corporate or user/consumer
information by Internal or External threat actors?
Now Expect in the next 18 months
34%
37%
37%
40%
41%
39%
45%
41%
48%
48%
0% 20% 40% 60%
Hacktivists with political agendas
State-sponsored professionals targeting national infrastructure and
promoting cyber-terrorism
State-sponsored professionals targeting economic / IP theft (corporate
espionage)
Organized crime-sponsored professionals
Well-organized teams of professionals working for themselves targeting
personal / corporate information for resale
What level of concern do you have for the following threat groups?
(Strong & Critical Concern only)
In 12-18 MONTHS
Today

Moving forward 12-18 months, the “Major/Critical” threats shift
19%
22%
24%
25%
28%
29%
29%
29%
31%
33%
34%
35%
35%
31%
35%
37%
34%
35%
33%
32%
32%
39%
41%
36%
39%
37%
0% 10% 20% 30% 40% 50%
Denial of Services (DOS, DDOS)
Data Theft Corporate Information by insiders
Botnets / Zombies / Other Software Threats
Ransom-ware (or similar at the corporate level)
Phishing / Spear-Phishing
Website Hacks (defacing public materials)
Unauthorized physical access in office facilities
Unauthorized physical access in data facilities
Data Theft Personal Information by outsiders
Data Loss / Destruction
Software (Trojan, malware, virus, spyware, etc)
Data Theft Personal Information by insiders
Data Theft Corporate Information by outsiders
How concerned were you during the prior 12 months of the following threats and how concerned are
you moving into the coming 12 to 18 months?
(responses citing Major or Critical Concern only)
COMING 12 TO 18 MONTHS PRIOR 12 MONTHS

Enterprise Digital Trust is Challenged by 5 Critical Gaps
These gaps – between security requirements and operational reality – are disrupting the
ability of cybersecurity professionals to secure the extended enterprise
TALENT
TECHNOLOGY
MANAGEMENT
BUDGET
PARITY
Five Gaps that are Inhibiting Digital Trust TALENT GAP: Between the technical and operational skill-
set required and the pool of available talent – despite the
increased value to be gained through automation.
TECHNOLOGY GAP: Between the growth of cyber threats
and the ability to quickly deploy and leverage new
technologies in support of securing business initiatives.
PARITY GAP: Between cyber preparedness (and threats) in
different regions, across different verticals, and within the
extended enterprise ecosystem – critical for multi-national
organizations.
BUDGET GAP: Partly fueled by financial realities and partly
fueled by management focus, between the level of budget
required and available funds on hand.
MANAGEMENT GAP: The perception gap between
executive management and security operations
management – perhaps the one gap that, if addressed, can
lead the way in closing the other gaps.

TALENT: Cybersecurity needs improvement across the board
42% of respondents believe they need additional budget for hiring security talent and/or training, while 31% of respondents list
either lack of training or staffing budget as their single biggest inhibitor to cybersecurity provision.
54% of respondents (70% within EMEA) indicate their employees are underprepared to prevent security breaches (Not Well
Prepared, Somewhat Prepared, or merely Adequately Prepared).
“Acquiring top talent is a start, but continually “upgrading” existing talent through rigorous
training and testing programs is essential to cybersecurity in the 21st century”
77%
76%
77%
75%
75%
75%
73%
74%
72%
76%
72%
22%
22%
22%
22%
22%
25%
25%
26%
28%
24%
27%
0% 25% 50% 75% 100%
Business [Unit] Alignment
Platform/Performance (including COOP)
Government Policies, such as GDPR or CISA
Controls to restrict data by geographic region
User Education and Awareness
Application Security
Governance/Compliance
Device Security
Data Integrity
Threat and Vulnerability Assessments
Identity/Privacy
How prepared are you [your staff] to handle each of the following?
(note: respondents had an "N/A" option not shown)
NEED SOME LEVEL OF IMPROVEMENT WE'RE STATE-OF-THE-ART

TECHNOLOGY: Technology is outpacing ability, but not the
threat
55% - the number of cybersecurity professionals in the Healthcare/Pharma sector that believe Cognitive/AI will be either Very or
Critically Important to their ability to become a secure, digital enterprise.
“Rapid evolution of technology and parity between the enterprise and the threat actor has
eliminated the concept of ‘technical’ state-of-the-art “
3%
3%
6%
7%
8%
12%
14%
18%
20%
21%
25%
31%
33%
0% 20% 40% 60% 80%
Encryption (network)
Firewalls
VPNs and Segmentation
Virtual Desktops (VM)
Physical / Digital Security
Encryption (mobile, access control)
Data Analytics
Behavioral Tracking (employee / partner)
Identity & Access Management
Automation (inc Autonomics & RPA)
Behavioral Tracking (consumer / client)
Data Anonymization
Cognitive Computing / AI
Indicate how important you feel each of the following technologies are today and hot important
they will be within 12 to 18 months?
TODAY
IN 12 TO 18 MONTHS
% INCREASE
New Technology
New Budget
New Skills
Commodity Technology
Existing Budget
Common Skills

PARITY: Enterprises face inequalities in the cybersecurity realm
Based on 1:1 interviews with enterprise cybersecurity and service provider professionals, there is reason to believe this number
may be accurate but that the depth of vetting at this point may not be significant.
“The enterprise is only as secure as its least secure partner, and differences between both
internal and external stakeholders continue to put Digital Trust at risk“
35%
45%
48%
50%
50%
51%
52%
52%
52%
57%
42%
51%
46%
45%
42%
44%
44%
47%
43%
41%
23%
4%
6%
5%
8%
5%
4%
1%
5%
2%
0% 20% 40% 60% 80% 100% 120%
BPO Partners (F&A, HR, Procurement, etc.)
Legal Partners
Marketing Partners
IP/Development Partners
HR/Payroll/Training Partners
Manufacturing/Distribution (Supply Chain) Partners
R&D, Design, and Engineering Partners
Financial/Banking/Credit Partners
Insurance Partners
Credit Partners
Do you have a mechanism or set of policies (SOP) to vet ecosystem partners for their own
cybersecurity integrity and preparedness, and where do you expect to invest over the coming 12 to 18
months?
VETTING NOW
INVESTMENT
GAP (NO PLANS TO VET)

PARITY: Enterprises face inequalities WITHIN the enterprise
Sales and Call Center operations continue to drag down the cyber-preparedness within the enterprise, and call into question the
ability to secure customer data that frequently spans multiple enterprise “silos”.
“Differences between operational units within the enterprise – where data is often shared
freely – continue to put Digital Trust at risk“
67%
53%
47% 45%
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
IT Support Operations Back Office and Operations Call Center Sales Force
How cyber-secure is <the following> within your organization?
(respondents indicating Well or Very Well Secured only)
NORTH AMERICA EMEA AP (ex INDIA) INDIA LATIN AMERICA TOTAL

BUDGETS: Enterprises face inequalities WITHIN the enterprise
62% of respondents indicate that the
biggest inhibitor to their organization’s
security provision is budget-related.
Other inhibitors include: Legacy (Fixed)
Security Services Contracts – 10%; Limited
Awareness of Potential Risks and/or
Emerging Threats – 11%; and Limited
Support from Corporate/Executive Level –
16%.
“Budgets are never truly unlimited, and while ‘how much is enough’ is debatable,
cybersecurity professionals continue to deal with funding shortfalls that directly translate to
less advanced technology and shortages of adequately trained staff”
42%
26%
16%
12%
4%
0%
10%
20%
30%
40%
50%
We have enough budget for
technology but need additional
security talent and/or training
We have enough budget for both
technology and security talent
We have a well-trained staff, but are
lacking technology and/or services
resources
Inadequate to keep pace with the
rising threats and/or we're being
asked to cut back on overall expenses
We seem to have an uncapped or
unlimited budget in this area
Which of the following most accurately describes your current funding/staffing levels for Cybersecurity?
Budget-
related, 62%
Limited support
from
Corporate/Executiv
e Level, 16%
Limited Awareness
of Potential Risks
and/or Emerging
Threats, 11%
Legacy (Fixed)
Security Service
Contracts, 10%
Other, 1%
Which of the following are the (single) biggest inhibitors to your
organization's security provision?
“Budget-related” includes:
• Lack of Security
(technology/service
s) Budget (18%)
• Lack of Training
Budget (17%)
• Lack of Staffing
Budget (14%)
• Extended Budget
Cycles (13%)

BUDGETS: Vertical industry perspectives highlight budget risks
“The extended ecosystem often spans multiple verticals, geographies, and businesses of
different scale. Inequalities in cyber-preparedness between these entities is cause for concern”
14%
23%
18%
26% 24%
11% 13%
21%
20%
14%
11% 16%
20% 16%
14%
13%
14%
16%
16%
11% 16%
7%
7%
7%
16% 12%
20% 19%
0%
10%
20%
30%
40%
50%
60%
70%
80%
Media &
Technology
Banking &
Financial Services
Resources Healthcare /
Pharma
Public Sector /
Government /
NGO
Products Other
Which of the following are the biggest inhibitors to your organization’s security provision?
(single biggest budgetary inhibitor, by industry)
Lack of Security (technology/services) Budget Lack of Training Budget Lack of Staffing Budget Extended Budget Cycles
Legacy approaches to cybersecurity budgets – as a cost of securing data – no longer meet the current/emerging threat
environment. Achieving a state-of-the-art cybersecurity mindset – and driving enterprise-wide Digital Trust – requires an
approach that treats cybersecurity costs as enablers of data utilization

MANAGEMENT: Highlighting the need for executive leadership
43% of respondents cite a Culture of Cybersecurity Awareness as Very or Critically Important to the overall business of the
enterprise (#2 behind Cloud Computing).
36% of respondents believe management considers security an unnecessary cost.
“Leadership will be critical in creating an enterprise mindset that is focused on both corporate
and personal data responsibility and security – without leadership, digital trust for the
enterprise brand cannot be achieved ”
36.0%
41.8%
9.6% 12.1%
0.5%
34.1% 34.1%
15.4% 15.4%
1.0%
-1.9%
-7.7%
5.8%
3.3%
0.5%
-20.0%
-10.0%
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
CEO CIO COO CRO Other
Which of the following best describes your Security Management Reporting Structure today, and
how do you believe it should change within 12-18 months?
(data shows % of reporting lines) TODAY
NEXT 12-18
MONTHS
Change

MANAGEMENT: I can’t get no [reporting] satisfaction
Over 90% of currently reporting to a Chief Risk Officer (CRO) are dissatisfied with the reporting structure.
Dissatisfaction with reporting to the Chief Executive Officer (CEO) ranges from 32% to 61% depending on job title.
“Communication and collaboration between operational security management and executive
management is essential to both promoting a culture of cybersecurity awareness and
executing on the enablers of Digital Trust”
32%
46%
50%
57%
61%
75%
89%
100%
0% 50% 100%
Chief Information Security Officer (Reports to CEO)
VP / Director of Security (reports to CIO)
Chief Risk or Trust Officer (Reports to CEO/BoD)
Chief Information Security Officer (reports to CIO)
VP / Director of Security (reports to CEO)
VP / Director of Security (reports to COO)
VP / Director of Security (reports to CRO)
Chief Information Security Officer (Reports to CRO)
Which % respondents want to change reporting lines?
(grouped by current reporting structure)

Asking the right questions…
“The near-term agenda must be on closing the cybersecurity gaps that exist today, with
talent, technology, parity, budgets, and cybersecurity oversight and management”
Are we properly allocating
budgets and resources?
Are we measuring the costs
and results of cybersecurity
correctly?
Are we properly anticipating
and leveraging new
technologies and processes
Are we ensuring parity of
protection across the
extended enterprise
ecosystem?
How can we best transform
cybersecurity to achieve a
holistic state-of-the-art
approach to leveraging data
assets?
EXECUTIVE
LEADERSHIP
driving
state-of-the-art
Cybersecurity
Processes
and
Digital Trust

Taking the right steps…
“The future of the digital enterprise relies upon the ability of cybersecurity professionals,
working in tandem with business units, executives, partners, providers and end users to create
an environment of digital trust where business can flourish.”
Executive management must assume a visible, vocal, and engaged position on
cybersecurity, driving a culture that fosters digital trust.
Cybersecurity talent must be acquired, trained and developed, leveraging holistic
security practices and emerging technologies to better address cyberattacks.
Cybersecurity operations and executive management must collaborate to identify
and close gaps between security requirements and execution ability.
Enterprise cybersecurity teams must establish innovation and testing capabilities to
rapidly and cost-efficiently identify, vet, and test new and emerging technologies to
keep pace with the evolution of cyber threats.
Shift how cybersecurity funding is viewed, moving away from treating costs as
overhead to a holistic approach that includes the cost of securing data and allowing
it to be used as part of overall business initiative financial requirements.

Questions?

Christine Ferrusi Ross
Research Vice President, Strategy and Product Development, HfS Research – Boston, MA
Overview
§ Christine Ferrusi Ross focuses on helping firms solve complex client problems by developing new
service offerings and products to meet new market demands. At HfS she’s working with the
team to grow the successful HfS Summits program with a global remit across IT and Business
Process Services.
Previous Experience
§ Christine is a veteran of the IT services industry and the analyst community. She pioneered some
of the industry’s first research into vendor management and supplier risk, as well as building
blockbuster sourcing conferences and peer communities. Christine has helped some of the
largest companies in the world operationalize their sourcing strategies and supplier risk efforts.
§ From a domain perspective, Christine is passionate about supplier and supply chain risk, Internet
of Things, democratizing big data and analytics, and—in large part thanks to her children—
marketing best practices as exemplified by video game designers and Korean boy bands.
§ She’s been quoted in the Wall Street Journal, on CNBC, and other national media regarding IT
services, vendor management, supplier risk, outsourcing, and globalization.
Education
§ Christine holds a dual degree from Boston University: a BA in International Relations and a BS in
Mass Communications.
christine.ferrusi.ross@hfsresearch.com

Fred McClimans
Research Vice President, Digital Trust & Cybersecurity, HfS Research – Washington, DC
Overview
§ As the lead analyst for our Digital Trust and Cybersecurity practice, Fred focuses on the enablers
of Digital Trust, including Cybersecurity, Customer Experience, and emerging technologies, such
as Blockchain, that offer both incremental technology and “trusted” process innovation.
Previous Experience
§ Previously, Fred was the vision, and CEO, behind Current Analysis, a global market intelligence
firm in the IT and services sectors (now part of PDM), and the co-founder of Decisys, an analyst
advisory firm focused on vendor strategies and enterprise architectures (now part of Gartner). A
former Gartner analyst, Fred also served as a Manager in the Technology Practice of Ernst &
Young, the North American Business Unit Manger of the Advanced Technology Group of
Newbridge Networks, and as the Chief Information Officer at DTECH LABS.
§ In addition to authoring a book on communications infrastructure (McGraw-Hill, 1991) and
contributing to “Shift&Reset: Strategies for addressing serious issues in a connected society”
(Wiley&Sons, 2011), his work on digital technology and trends has appeared in media outlets
such as CNN, IDG, Social Media Today, Adotas, and CIO Magazine.
§ As a speaker he has chaired the Enterprise Mobility Conference in Washington, DC, led working
sessions at the Intellifest/Rulesfest AI conference, spoken on Digital Trust at SXSW, and keynoted
the LatAm ANDI Sourcing Summit in Cartagena, Colombia.
Education
§ Syracuse University
fred.mcclimans@hfsresearch.com
@fredmcclimans

Steven Curtis
Managing Director, Accenture Security
Overview
§ Steven Curtis has over seventeen years’ experience delivering complex security projects and
building strategic technology programs for Fortune 1000 firms. He has consulted to 20 of the
Fortune 100, and managed strategic engagements throughout the project lifecycle for over 100
companies. Steve co-leads Accenture’s security team focused on clients in the CMT industry, and
works with major software, telecom, and aerospace clients.
§ Prior to working with Accenture, Steve led the services division of Identropy, an identity
management focused service provider, and was a security practice Director for
PricewaterhouseCoopers. He was responsible for developing and executing PwC’s information
security assessment and planning framework, managing sales and alliances, and delivering
consulting operations for more than 50 Fortune 1000 clients.
§ Steve has a BBA from the University of Wisconsin –Madison, specializing in Information Systems
and an MBA from the UCLA Anderson School of Management. Steve is also a PMP®.
steven.curtis@accenture.com

Ryan LaSalle
Managing Director, Global Growth and Strategy, Accenture Security
Overview
§ Ryan LaSalle is Managing Director, Global Growth and Strategy, Accenture Security. Ryan
oversees Accenture’s strategic roadmap for the security practice—including offering
development, industrialization, strategic alliances, innovation and Cyber Labs—helping clients
dramatically improve their ability to adapt and thrive in an evolving threat landscape.
§ As a senior member of the global security leadership team, Ryan directs the go-to-market plans
for enabling client value with responsibilities for embedding next generation innovation into
Accenture's suite of security offerings. These differentiated offerings drive transformational
value and productivity for clients across strategic industry groups—and are delivered through
Accenture’s Global Delivery Network, which consists of more than 50 delivery centers across five
continents. Prior to assuming his current role, he was managing director of Cyber Labs—part of
Accenture’s cross-industry research and development Technology Labs—where he lead the
incubation and launch of mission-focused and active defense strategies.
§ During his 17 years with Accenture, Ryan has led client engagements across commercial, non-
profit and the public sector by integrating emerging technologies into advanced solutions to
drive agility and meet business needs. He consults with customers on focused solutions that
bring together analytics, knowledge discovery, and cyber-security to improve threat assessment
and response methodologies.
§ A widely recognized thought leader, Ryan is a Ponemon Institute Fellow, active with the Greater
Washington Board of Trade and sits on security innovation advisory councils for clients across
multiple industries. He holds patents in human resource management, knowledge discovery and
establishing trust between entities online. Ryan is a frequent speaker at international security
conferences and has authored numerous articles on cybersecurity. Ryan holds a bachelor of
science degree in electrical engineering from Princeton University and resides in Alexandria,
Virginia with his wife Melissa and two children.
ryan.m.lasalle@accenture.com

The State of Cybersecurity and Digital Trust 2016

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie The State of Cybersecurity and Digital Trust 2016

Ähnlich wie The State of Cybersecurity and Digital Trust 2016 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

The State of Cybersecurity and Digital Trust 2016