How does security evolve from bolted on to built-in?

CISOs pursuing and driving a culture of Security by Design can play a crucial role as enablers of transformation.

In the face of mounting cyber threats, many organizations go on the defensive – and miss a golden opportunity to gain a competitive edge by putting enhanced cybersecurity and privacy at the heart of their strategy.

To make the shift to a culture of Security by Design, CISOs must embrace the commercial realities facing their organizations in a disruptive marketplace. And the rest of the business, from board level down, must ensure cybersecurity has a seat at the leadership table.

The shift is a shared responsibility: CISOs can – and must – engage more collaboratively with the rest of the business, while boards, C-suites and other business functions must commit to a closer working relationship with their cybersecurity colleagues. Only in this way can cybersecurity teams play a crucial role as enablers of transformation.

In this year’s EY Global Information Security Survey (pdf), we look at the evolving role of the cybersecurity function from three perspectives:

1. A systemic failure in communication

Activist attackers were the second-most common source of material or significant breaches, the report shows. The increase in activist attacks underlines how the cybersecurity function needs a much deeper understanding of its organization’s business environment. CISOs who do not work collaboratively with colleagues across the business will inevitably be side-stepped by other functions and lines of business which could, for example, launch new products or services that expose the organization to new threats.

Early findings from the forthcoming EY Global Board Risk Survey identified “Technology Disruption” as the greatest strategic opportunity for organizations. The fact that many organizations are seizing on this opportunity by undergoing technological transformation also requires CISOs, the board and C-suite, and the business to work together even more closely. This is so that they can embed cybersecurity solutions at a much earlier stage of new business initiatives – a culture of Security by Design.

• The cyber and privacy threat is increasing and expanding. About 6 in 10 organizations (59%) have faced a material or significant incident in the past 12 months, and as the EY Global Board Risk Survey reveals, 48% of boards believe that cyber attacks and data breaches will more than moderately impact their business in the next 12 months. About one-fifth of these attacks (21%) came from “hacktivists” (that is, tech-enabled, political and social activists) – second only to organized crime groups (23%).
• Only 36% of organizations say cybersecurity is involved right from the planning stage of a new business initiative.
• Cybersecurity spending is driven by defensive priorities rather than innovation and transformation: 77% of new initiative spending focused on risk or compliance rather than opportunity.
• One in five respondents spend 5% or less of their cybersecurity budget on supporting new initiatives.

2. Increase trust with a relationships reboot

So, with Security by Design as the goal, CISOs and their colleagues across the organization – including functions, such as marketing, R&D and sales – need to form much closer relationships in order to improve overall business understanding of cybersecurity and meet the mark of Security by Design. 

Increased collaboration with other functions must be a priority, but cybersecurity also needs to form much more productive relationships with the board, the C-suite and senior leaders.