Cyber threats are increasing in their 2. levels of persistence, sophistication and organisation. The damage caused by a cyber attack can severely impact a business. Even if you have not experienced an attack yet, you should assume that your organisation will be targeted, or that your security has already been breached.

You could be under cyber attack now

Cybersecurity attacks have increased 3. exponentially in the last few years. As the evolution of technology marches forward, more complex cyber risks emerge, threatening significant harm to an organisation's brand and bottom line. The infiltration could have occurred days, weeks or even months ago without the 4. organisation being aware of it. When the knowledge and magnitude of the breach does surface, the associated costs to the organisation may be staggering.

The disappearing perimeter

Cyber threats will continue to multiply. The advent of the digital world, and the inherent interconnectivity of people, devices and organisations, opens up a whole new playing field of vulnerabilities. The short summary below highlights the top five reasons why effective cybersecurity is increasingly complex to deliver: they illustrate that the security defences of organisations are under increasing pressure, further eroding the traditional perimeter and, in turn, creating more motivation for threat actors.

• Change. New product launches, mergers, acquisitions, market expansion, and introductions of new technology are all on the rise: these changes invariably have a complicating impact on the strength of an organisation's cybersecurity.
• Mobility and consumerisation. The adoption of mobile computing has resulted in blurring organisational boundaries, with IT getting closer to the user and further from the organisation. The use of the internet, smartphones and tablets (in combination with personal devices) has made organisations’ data accessible everywhere.
• Ecosystem. We live and operate in an ecosystem of digitally connected entities, people and data, increasing the likelihood of exposure to cybercrime in both the work and home environment.
• Cloud. Cloud-based services, and third-party data management and storage, has opened up new channels of risk that previously did not exist.
• Infrastructure. Traditionally closed operational technology systems are now being given IP addresses so that cyber threats are making their way out of the back-office systems and into critical infrastructures such as power generation and transportation systems, and other automation systems.

The roadblocks facing today's organisations

Concerns over cybersecurity have been increasing and attracting more attention at all levels within organisations. While they are taking actions to address cybersecurity risks, there are a number of roadblocks which need to be removed before organisations can successfully get ahead of cybercrime. 1. Lack of agility. There are known vulnerabilities in organisations' cyber defences. In other words, it is understood that there is a clear and present danger, but organisations are not moving fast enough to mitigate the known vulnerabilities. Due to the lack of real time insight on cyber risks, organisations are lagging behind in establishing foundational cybersecurity. 2. Lack of budget. The lack of budget is one of the most challenging roadblocks. We see more organisations reporting that their budgets on cybersecurity will remain flat. Although we are experiencing ever greater attention to cybercrime in the boardroom and from non-executive directors around the globe, it seems that this interest doesn’t translate into additional money. 3. Lack of cybersecurity skills. The most important roadblock is the lack of cybersecurity skills. While the need for specialists deepens, the lack of specialists is a growing issue. Also, there is the need to build skills in non-technical disciplines to integrate cybersecurity into the core business. Sophisticated organisations not only defend themselves against cyber attacks; they use analytical intelligence to anticipate what could happen to them and have the confidence in their operating environment to know they are prepared. Organisations find it difficult to hire the specialists necessary to perform the analysis on threat intelligence data, draw relevant and actionable conclusions, and enable decisions and responses to be taken.

How to make vital improvements

So what are the areas that need specific and increased attention? What 'low hanging fruit' would allow organisations to make progress easily? Below we outline four areas of improvement that need specific and increased attention. 1. Improve the Security Operating Centre (SOC) A well functioning SOC is an important asset to get ahead of cybercrime. If there is one security function in the organisation that should be aware of the latest threats, it is the SOC. In our latest GISS, we noted an alarming result where organisations felt that their SOC was not keeping up to date with the latest threats. One of the root causes is that SOCs are overly focused on the technology. Although the features of the technology are important, the starting point should be the business. The SOC will not be able to focus on the right risks (and changing risks) if the business is not connected to the SOC on a regular basis. 2. Create a core cybersecurity team By establishing cybersecurity knowledge in a core team, organisations will be able to adapt to new threats more easily. This core team can be organised centrally or distributed across functions/ borders depending on the size and the requirements of the organisation. The core team should also focus on training, skills and awareness, and make the practice of information security part of everyday life for every employee. 3. Establish accountability Greater accountability and performance measurement are key ways to achieve behaviour change. If employees understand that their own job security is under threat because the security of the organisation is under threat, and that cybersecurity is a performance metric, this will encourage a permanent change in awareness and behaviour. Breaches of information security protocols should be taken very seriously. In addition to informing employees about cyber threats, find ways to make them the 'eyes and ears' of the organisation and ensure there is a clear escalation process everyone can follow in the event of an employee noticing something suspicious. Forensics support and social media could be the first way of spotting that the organisation is at risk of an attack. 4. Go beyond borders With a transformation cycle in place, organisations can start to look beyond their own borders, and begin to assess the impact of a cyber attack on their business partners, suppliers and vendors – a community that can be described as their business 'ecosystem'. Their own effective transformation will reveal leading practices, and these practices can be communicated to the ecosystem so that suppliers and vendors can be contractually obliged to conform.

Get ready to anticipate

No organisation or government can ever predict or prevent all attacks; but they can reduce their attractiveness as a target, increase their resilience and limit damage from any given attack. Learning how to stay ahead is challenging and takes time but the benefits for organisations are considerable. They will be able to exploit the opportunities offered by the digital world while minimising exposure to risks and the cost of dealing with them.

Understand your threat environment and establish early detection

It is not enough to just know that there are threats. Organisations need to understand the nature of those threats and how these might manifest themselves, and assess what the impact would be. Early warning and detection of breaches is key to being in a state of readiness. However, the majority of organisations are only able to detect fairly simple attacks, meaning they may not know they have already been breached by a more sophisticated attack and they will not be able to detect future attacks of this nature. Incorporating or establishing a cyber threat intelligence capability can help get organisations ahead of cybercrime. At a tactical level, this capability will sit in the SOC, but the reach of this function will extend into the strategic level and the C-suite, if done well.

Take a view of the past, present and future

The organisation's ambition needs to encompass efforts to look into the future, as well as learning from the past and being prepared for the now. Organisations should be kept informed of new/ different trends in attack types and in the methods, tools and techniques to deal with them. It is vital to be kept informed about emerging technologies, and to keep exploring the opportunities for the business to exploit these, while keeping a firm eye on the new risks and weaknesses they may introduce.

Get involved and collaborate

Information and intelligence sharing platforms exist in many forms. Governments and major organisations have started to take a leading role in establishing the policy and practice frameworks that support the development of resilient cyber ecosystems. Collaboration provides organisations with greater awareness of their partners and supply chains, and the ability to influence and learn from the whole ecosystem. Larger organisations need to understand that their security capabilities are often far more mature than those of some of their suppliers, so knowledge-sharing around cybersecurity, or coordinating cybersecurity activities with suppliers can be much more effective than going it alone. A shared solution tightens the protective layers in and around your ecosystem. However, it would require an organisation to develop a 'trust model' based around authentication, assurance agreements, etc. Any incident response exercises should include third parties and other players in your wider ecosystem.

Cyber economics

Organisations are using these four questions to assess the impact of a cyber attack in real-world terms, to understand the impact on the bottom line and the organisation's brand and reputation.

• How would the share price be affected?
• Would customers be impacted?
• Will this translate into reduced revenues?
• What will the costs be of having to repair damage to all internal systems and/or replace hardware because the  organisation was not prepared for an attack?

Cyber economic techniques are being developed to help organisations convert this into tangible figures.

Conduct cyber incident exercises

Is the organisation confident that everyone knows what to do if an attack takes place? If not, then the damage from the attack will be far greater than expected. Poor handling of cyber incidents have led to harsh impacts on many companies. Once a breach is detected, then having thorough knowledge of your critical assets and associated ramifications will allow your organisation to set in motion the appropriate handling mechanisms. Stakeholders, customers, employees, PR, regulators – all these parties play a part in determining how well your organisation weathers an attack. Being in a state of readiness requires that an organisation will have already rehearsed many different attack scenarios. At least once a year, organisations should rehearse their crisis response mechanisms to complex cyber attack scenarios. Regulators in some areas are now requiring that such rehearsals are undertaken and the results reported.

What organisations need to do

Every day, cyber attacks become more sophisticated and harder to defeat. No one can tell exactly what kind of threats will emerge next year, in five years’ time, or in 10 years’ time. It is inevitable that these threats will be even more dangerous than those of today. Despite this uncertainty, organisations need to be clear about the type of cybersecurity they need. To get cybersecurity right, the first step is to get the foundations right. Given how much attention recent cyber attacks have received, no one can claim they do not know the dangers. There can be few excuses for organisations that are still not putting basic cybersecurity systems and processes in place. Once the foundation has been mastered, the next stage is to make your cybersecurity more dynamic and better aligned and integrated into key business processes. Without taking this crucial step, organisations remain vulnerable since they, their environment and the cyber threats they face are all changing. By focusing your cybersecurity on the unknowns – the future and your business's broader ecosystem – you can start building capabilities before they are needed and begin to prepare for threats before they arise. Organisations should take the initiative and make cybercrime far less profitable and a far less effective use of time and resources than it is today. In other words, take away the power of the hacker and get ahead of cybercrime.   Keith Yuen, Partner, and Alan Lee, Executive Director, EY Keith Yuen can be contacted at tel: +86 2122282252, or email: Keith.Yuen@cn.ey.com Alan Lee can be contacted at tel: +852 26293160, or email: Alan.Lee@hk.ey.com

3. 生态系统。我们生活及处于一 个机构、个人和资料互联的生态 系统中,从而增加了在工作和家 庭环境中遇到网络犯罪的风险。

4. 云端服务 。云端服务及第三方数 据管理与存储,衍生了新的风险 入侵途径。 5. 基础设施 。以往封闭的营运技术 系统,现今已经配置了互联网协 议地址, 因此网络安全威胁已经 从办公室后勤系统走入重要基础 设施, 例如电力和运输系统以及 其他自动化系统。

1. 反应欠敏捷。企业的网络防御 存在已知漏洞。换言之,即是 尽管企业了解目前明确存在的 危险,但未能采取迅速行动来 作出补救。由于企业对网络风 险缺乏实时监控,因此在构建 基础网络安全方面显得滞后。 2. 预算不足。预算不足是其中一 项最难克服的障碍。我们看到 有更多企业表示其在网络安全 方面的预算将不会有所加增。 虽然董事会和全球非执行董事 对网络犯罪的关注超过以往任 何时候,但此等关注似乎并没 有转化成额外的资金投入。