Cyber challenge now extends beyond the Enterprise

1. www.pwc.com.au
October 2015
Digital Trust & Cyber
challenge now extends
beyond the Enterprise

2. PwC
Digital Trust
Securing your future in the digital world
2
Peter Malan lead Partner presents ‘ Take control of your future by looking at
risk differently’
Digital Trust
https://takecontrol.pwc.com.au/digital-trust/

3. PwC
PwC’s 2015 Survey’s, what we are seeing.
3

4. PwC
2015 Global state of information security survey
PwC and CSO Magazine recently launched the 2015 Global State of Information Security Survey
Key findings:
• 61% of customers would stop using a company’s product if there was a
breach in their security.
• Cyber security came third at 44% , in the top 3 risks categories.
• Reported information security incidents globally rose 48% to
42.8 million.
• Losses of $20 million or more increased 92% from the previous year
• Estimated reported average financial loss from Cyber security
incidents was $2.7 million – a 34% increase over 2013.
• Incidents caused by current employees increased 10%, service
providers, consultants and contractors rose 15% and 17%.
• 75% of CEOs now regard digital security as a serious threat to their
business.
• Only 49% of respondents say their organisation regularly convenes
to discuss, coordinate, and communicate Cyber security issues.
• 34% of respondents do not allocate security spending to their most
profitable lines of business.
• 88% of organisations are spending less than 1% of their revenue
Survey highlights
Cyber risks are a severe and
present danger 1
Incidents and financial impacts
continue to soar 2
Employees are the most cited
culprits of incidents 3
As incidents rise, security
spending is falling 4
There is a lack of involvement at
the Board level 5
There has been a decline in
fundamental security practices 6
4

5. PwC
2015 Global state of information security survey
PwC and CSO Magazine recently launched the 2015 Global State of Information Security Survey
Survey highlights
Cyber risks are a severe and
present danger 1
5

6. PwC
2015 Global state of information security survey
Incidents caused by current employees increased 10%.
Survey highlights
Incidents and financial impacts
continue to soar 2
Employees are the most cited
culprits of incidents 3
As incidents rise, security
spending is falling 4
6

7. PwC
2015 Global state of information security survey
Disconnect between increased level of concern and organisations focus
Survey highlights
There is a lack of involvement at
the Board level 5
7
of respondents review
privacy or cybersecurity
at every board meeting.
Only 8%
of respondents
rated their Board’s
oversight of privacy and
cybersecurity risks as weak,
or sufficient but needing
improvement.
95%
Many organisations have yet to assign specific role to govern privacy and cybersecurity risks,
and still view privacy and cybersecurity risks as a technology or legal / compliance issue.
Concern vs reality:

8. PwC
2015 Global state of information security survey
PwC and CSO Magazine recently launched the 2015 Global State of Information Security Survey
Survey highlights
There has been a decline in
fundamental security practices 6
8

9. PwC
The Digital World, an evolving perspective
9

10. PwC
Waves of digital transformation
10

11. PwC
The changing digital world
• Business is becoming ever increasingly interconnected
• The borders of where a business supply/value chain
starts and ends is vague
• Governments around the world are placing
a heightened level of focus and investment
into combatting cyber criminals and cyber espionage
• Corporations are being targeted directly by ‘hackers’
and indirectly via their business partners
• Company Boards need to understand the risks to their
business
- What risks are being inherited via third
party suppliers?
- Is Cloud enhancing or undermining
your business?
- Do only the right people have access to your
systems in a more ‘open’ world?
- Data, availability, integrity and
confidentiality are key to integration as part
of the business supply chain?
• Digital Trust is a key attribute in the new digital
business world.
11

12. PwC
Historical
IT Security
Perspectives
Today’s Leading
Digital security
Insights
Scope of the challenge • Limited to your “four walls”
and the extended enterprise
• Spans your interconnected global
business ecosystem
Ownership and
accountability
• IT led and operated • Business-aligned and owned; CEO
and board accountable
Adversaries’
characteristics
• One-off and opportunistic;
motivated by notoriety,
technical challenge, and
individual gain
• Organized, funded and targeted;
motivated by economic, monetary
and political gain
Information asset
protection
• One-size-fits-all approach • Prioritize and protect your “crown
jewels”
Defense posture • Protect the perimeter;
respond if attacked
• Plan, monitor, and rapidly respond
when attacked
Security intelligence and
information sharing
• Keep to yourself • Public/private partnerships;
collaboration with industry working
groups
12
Evolving perspectives
Considerations for businesses adapting to the new reality

13. PwC
Organisations are facing increasing digital challenges
13
Digital
Trust
“eBay data breach
sparks lawsuit”
Source: www.itnews.com.au
“Microsoft ordered to hand over
overseas email”
Source: www.zdnet.com
“40 million card numbers
and personal data stolen
from Target systems in
Nov/Dec 2013”
Source: www.target.com
“Hackers steal confidential
personal data from Sony
Pictures Entertainment
resulting in lawsuits”
Source: WIKI
“Target shares tumble as
retailer reveals cost of
data breach”
Source: www.forbes.com
“Bank IT ‘glitch’ leaves bank
facing £1bn bill”
Source: www.telegraph.co.uk
“Enterprises hacked after
neglecting third-party risks”
Source: www.csoonline.com
“Bank chief blames lack
of investment for IT
systems failure ”
Source: www.ft.com
Each of these incidents has an
impact on the level of
perceived trust by customers
and other key stakeholders

14. PwC 14

15. PwC 15

16. PwC
Data availability, integrity and
confidentiality, key to integration as part of
the business supply chain?
16

17. PwC 17
Digital technology is changing customer behaviour and business models at an
exponential rate and creating extraordinary and unforeseen opportunities for
growth and development.
Trust + Opportunity
= Business Growth
Opportunity and Danger
• Looking at digital security through the lens of
trust means you are considering the wider
business context in which you operate.
• In the digital space, your customers rely on you
to protect their information and privacy. If your
systems fail you, they will feel that you have
failed them.

18. PwC 18
Digital Trust, business enablers
• Build Trust –
• Focus on people and process not just technology
• Education and awareness - Raise digital knowledge and
awareness across internal staff.
• Focus on departmental relationships and trust
• Relational business partnership
• Be proactive and present a cooperative and collaborative face
of digital security.
• Being directors of change and thought leaders in the space.
• Present innovation, be solution
• Change how you present Cyber or security, it is all in the
wording…
• Does you organisation have an aversion with “Cyber’’ or
“Security” use Digital/trust?
• Opportunities –
• Mobile, cloud, analytics – technology to enhance
• Be approachable - the business will seek advice and
solutioning, they will come to you.
• The relationship will yield opportunities
Trust + Opportunity
= Business Growth

19. PwC 19
Building trust in the digital age
Managing risk
and building trust
underpins the digital
agenda as digital
platforms become
increasingly central
to the delivery of
business strategy.
To build trust you
will need confidence
in each of these
five areas:
Confidence in your security
.
Confidence in your data
Confidence in your systems
Confidence to take risks
Confidence in your digital transformation
programme
Supplier Security Ongoing Security Identity Management
Privacy and Data
Cloud Assurance Oracle ERP Controls SAP ERP Controls
Continuity and ResilienceIT Risk Diagnostic
Project Assurance

20. PwC 20
Key focus areas we too easily forget
• The majority of organisation has a multitude of
technologies.
• Data indicates that technology is not usually the key
issue, it is the lack of people and business process
that support the technologies and its process:
• People – Roles and responsibilities.
• Education and awareness (training).
• Processes – Lack of policies, standards etc.
• Governance offering the business .
assurance.
1
People, Process &
Technology

21. PwC 21
Key focus areas we too easily forget
• We too easily forget what end–to- end digital security
management is for.
• Availability
• Integrity
• Confidentiality
• We need to help the business through Education and awareness
as to why Digital security supports all 3 areas of the business.
Security is not just about technology.
• We have for too long segregated the business from IS.
• IS needs to become the conduit or integration layer between the
business and the new Digital Enterprise (Trust).
• Trust + Opportunity = Growth
2
Availability, Integrity & Confidentiality
of respondents rated
their Board’s oversight of privacy and
cybersecurity risks as weak, or
sufficient but needing improvement.
95%
of
respondents review privacy or
cybersecurity at every board meeting.
Only 8%

22. PwC
Where to from here?
22

23. PwC
The oil and gas industry has traditionally lagged behind other sectors in
cybersecurity practices.
• 81% of organizations have implemented an overall information security strategy, the basic
foundation for cybersecurity.
• Last year, the US National Institute of Standards and Technology (NIST) compiled a range of
these global standards into a single model for risk-based cybersecurity.
• Among US oil and gas participants,
• 25% say they have adopted the voluntary NIST Cybersecurity Framework; an additional
• 13% say adoption is a future priority.
• Hiring a Chief Information Security Officer (CISO) to lead the information security program, a
tactic that 77% of oil and gas businesses have embraced.
• Over the past two years, the number of respondents who employ a CISO has spiked 57%.
• The majority of oil and gas respondents follow this best practice: Their CISOs are most likely
to report to the COO, legal counsel, the Board, or the CEO.
23
Improvements in key strategic safeguards
Companies are getting serious about business-focused cybersecurity strategies.

24. PwC
Linking information security/digital trust and risk
• As security incidents continue to proliferate, it has become clear that cyber risks can never
be completely eliminated.
• Protective measures remain important, of course, but they cannot reliably be guaranteed
to stop determined and highly skilled adversaries.
• Businesses may need to reposition their security strategy by more closely linking
technologies, processes, and people skills with overall risk management activities.
• While a well-designed cybersecurity program will not deter all risks, it can enable:
- businesses to better manage threats through an informed decision-making process,
- boost efficiencies in security safeguards, and create a more resilient security
program.
24
Improvements in key Strategic Safeguards

25. PwC
How do you become a 'digitally trusted' company?
• Trust is hard won and easily eroded. Ultimately it's about having confidence
that you have the right systems, processes and controls in place.
• Boards and their risk committees have an important role to play by asking
the right questions of management. Too often boards ask 'how strong are
our security controls?', when they should be asking 'do our customers and
other key stakeholders trust us and how do we maintain this trust?'
• Digital trust is as much about opportunity as it is risk. And it's the
companies that are 'trusted' to whom customers will increasingly turn in the
digital economy. How does your organisation stack up?
• Over leaf are some critical questions to determine how digitally trusted your
company is:
25
Are you and your partners digitally trusted?

26. PwC 26
Assess you digital trust profile:
Key Digital questions that you should be asking
Risk management
Have we identified our risk appetite, the key risks and threats to our business
presented by cyber? Are our controls 'right-sized'?
Strategic alignment Is our cyber security program aligned with our business strategy?
Information assets
Do we know where our data is physically held? Do we know where the 'crown
jewels' are (ie our most commercially sensitive and critical data)? What are our key
systems and business processes?
Network & system
architecture
Have we (and our service providers) segregated our systems and networks to
minimise the impact of any potential cyber security breaches? Especially to protect
the ‘crown jewels’.
Third party
management
With the increased reliance on third parties to deliver services, including Cloud
providers, what monitoring controls are in place and what ongoing assurance do
we have to be sure those parties are handling our data appropriately?

27. PwC 27
Assess you digital trust profile:
Key Digital questions that you should be asking
Online and digital
integration
With increasing connectivity (eg cloud, mobile, social networking) how are we
managing the ways members or third parties access our systems and our data?
Identity and access
management
How are we ensuring that the right people have access to our core systems and
data, especially privileged access? How do we know that people (employees,
suppliers or members) really are who they say they are?
Privacy & data
protection
How are you meeting member expectations from a privacy and data protection
perspective, particularly if we are keeping and analysing member data (ie 'big
data')?
Regulation
How are we sure that we are meeting our regulatory requirements in relation to
Cyber security?
Incident response
It's highly likely that we will be subject to a cyber security breach. What's our
incident response plan? How will we rebuild trust?
Do we know how to respond when we have been targeted?

28. PwC
Successful security models have the following characteristics:
• You continually monitor your risk profile. You understand what matters to the success of
your business. You realise this changes as you move forward with your business.
• You understand in real time, the new threats within the digital landscape. You are fully
aware of the risks you’re exposing the organisation to as you execute your strategic plan.
• You understand how digital is changing the fabric of your business, introducing new
threats and changing your risk profile.
• Your eyes are fully open to digital threats.
• You recognise boundaries have shifted: your business architecture has changed, so have
the risks within your digital supply chain. You are aware that threats can come from
within your organisation as well as from outside it.
28
Our point of View
What good looks like, going beyond best practise

29. PwC 29
Our point of View
When is it time to Act
There are logical triggers in your business that prompt action. Here are
some examples.
• Changes to regulation or legislation that will affect your business.
• Change in the form of new suppliers, new technology, acquisitions, new markets or a
change in leadership.
• Trends or developments in your market that are likely to affect your business and
where it’s better to respond proactively.

30. PwC 30
Our point of View
How do you benefit
A well managed digital security program will gain the
trust of your customers and clients. Provide you the
confidence to realise the full potential of the digital
environment for your business.
Below are the six confidences that will help you apply
digital security to the heart of your business.
- Confidence in your people and processes
- Confidence in your technology
- Confidence in your connections
- Confidence to take risks
- Confidence during a crisis
- Confidence in your priorities

31. PwC 31
Our point of View
How we can help
We provide market leading end–to-end solutioning across people, process and technology offering to
help you build trust, capitalise on the opportunities and navigate the risks in the digital age – building
growth.
We bring:
• Access to the largest network of global expertise and insights from helping leading organisations.
• A multidisciplinary offering to address the multifaceted and complex nature of digital risk and
security.
• Innovation in our thinking and our tools to help you manage risk in the rapidly changing digital
landscape.

32. www.pwc.com.au
References:
© 2015 PricewaterhouseCoopers. All rights reserved.
PwC refers to the Australian member firm, and may sometimes refer to the PwC network.
Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.
PwC’s 2016 Global State of Information Security Survey
http://www.pwc.com/gx/en/issues/cyber-security/information-security-survey/data-
explorer.html
PwC’s 2015 State of Compliance Survey
http://www.pwc.com/us/en/risk-management/state-of-compliance-survey/downloads.html
PwC’s Digital IQ Survey – Examining the digital health of Australian businesses
http://www.pwc.com.au/consulting/publications/2015-global-digital-iq-survey.htm
Take control of you future by looking at Risk differently – Peter Malan
https://takecontrol.pwc.com.au/digital-trust/
https://www.youtube.com/watch?v=BkkNifucWtE

33. www.pwc.com.au
If there is one question I leave
with you today,
‘Why is the digital world more
dangerous than the old world?
Questions time

34. PwC 34
Contact details
Further question, please forward or just call me
Mourad Khalil
Senior Manager Digital Risk
M: +61 403 980 718
mouradswork@gmail.com