Posted on

The Challenges of Data Governance in EU: Two Years Into GDPR

On 25th May of 2018, the now-renowned General Data Protection Regulation (GDPR) was fully implemented across the countries in the European Union (EU).

Superseding the 1995 Data Protection Directive, the GDPR addresses the processing, protection and portability of personal data within the EU and the European Economic Area (EEA).

 

How does the GDPR impact businesses?

 

Not only does the framework provide more control to individuals over the use and collection of their personal data, it also streamlines data regulations for businesses that are operating in the EU or offering their services to clients located in the EU.

Core dna best explains which companies are affected by the GDPR in the diagram below.


 

Through the 7 principles of the GDPR – lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability, organizations are expected to control and process data, whether consumer or company information, in compliance with the regulations.

To clarify, businesses collecting customer data must document and have evidence of consent for every purpose the data will be used for.

 

“[The] generic consent or opt-out consent does not comply with GDPR. […] For example, if someone opts into email marketing, you cannot use this consent to send them a letter or call them or their company.”

– GDPR for Business: What is GDPR and How Does it Impact You?

Digital Media Stream

 

What data does the GDPR cover?

 

The GDPR protects any private data that identifies a data subject (the customer), ranging from basic identity information and race or ethnicity to biometric data and political opinions. However, data that is irreversibly anonymous and unidentifiable is not considered as personal data and therefore, is not covered by the GDPR.

Thus far, the length of time a business is expected to store the data has not been firmly established, with the GDPR stating that the information should not be kept longer than necessary or required. In this case, organizations need to determine how long to keep the data based on either the national law or the purpose of the data collection and processing.

 

“Think about what is the purpose you want to achieve, and how long you will need the collected data to fulfill that purpose.”

– How Long Should You Keep Personal Data?

Data Privacy Manager

 

The only information that can be kept for longer retention periods are data used “for archiving purposes in the public interest, and for scientific or historical research purposes or statistical purposes.”

 

Who handles the data?

 

According to the GDPR’s Recital 39, the data controller, an individual or company that controls the processing and purpose of data, is responsible for ensuring that the personal data are not kept longer than necessary, and for establishing time limits for data erasure or periodic review.

There is also the data processor, usually a third-party person or organization, that processes the data on behalf of the data controller, which can include implementing security measures to safeguard the data. The controller must ensure that the assigned processor has sufficient guarantees “to implement appropriate technical and organizational measures” in compliance with the regulation.

Based on the GDPR, the regulation requires companies to assign a Data Protection Officer (DPO) if they store or process data on a large scale or if they are a public authority or body. Either internally or externally appointed, the DPO’s responsibilities include:

 

  • Informing and advising the company and employees on compliance requirements;
  • Awareness-raising and training of staff involved with data processing;
  • Monitor compliance and conduct related audits; and
  • Cooperating and acting as contact point with supervisory authority on issues relating to data processing.

 

What challenges are businesses facing in being GDPR-compliant?

 

Although companies are expected to be GDPR-compliant by May 2018, according to research, only 20% have completed their GDPR implementations as of July 2018. More than 2 years later, 27% still have yet to start on GDPR compliance while 60% of tech companies are also not prepared for GDPR.

Many organizations faced, and are still facing, difficulties in their journey to become GDPR-compliant. From changing the way they handle customers’ data to tackling challenges in data retention and deletion, some businesses believe that the regulation limits their ability to operate efficiently or run a profitable company.

 

  • Lack Of Readiness

 

Complacency, lack of understanding, competing laws, unfamiliarity with data processes and usage – these are some of the reasons behind organizations’ lagging or partial compliance with the GDPR. 

Research also stated last-minute data identification and other preparations in the final months before the deadline as another possible reason for the lack of readiness.

For most businesses, both big and small, it has been no simple feat to juggle the different aspects of being GDPR-compliant, from consolidating the data gathered over the years, training employees in data management, and hiring the different required roles, including talents in GDPR program design and implementation.

It’s even more difficult for international companies that need to comply with differing data privacy laws. And more often than not, all the complexities have led businesses to hiring individuals or companies to specifically handle compliance.

 

“My concern is that in the rush to be ready for the GDPR before 2018, and indeed since, many companies have engaged with individuals or organizations which haven’t given them proper advice with regards to their requirements.”

– Brian Honan, CEO of BH Consulting,

GDPR: The First Two Years and Future Challenges

 

In fact, according to TrustArc, 87% of companies needed help with GDPR and used external firms to understand the regulations, to gain tools and tech for automation and operationalization of data privacy, and new policy and process creation.

 

Solution tip: Break the regulations and processes into manageable tasks. Conduct a risk assessment to identify compliance and data security gaps, and establish a formal data governance program to map the type of data collected, its purpose, usage and storage, and how it’s shared.

 

  • Control of External Parties

 

Based on the GDPR, all third-parties that are accessing or will access the data of the controller, including vendors, partners and external data processors, must be in compliance with the regulations.

As Ian Evans, the Managing Director for EMEA at OneTrust, aptly put it, “You now have the obligation to ensure that the people you contract with – and who undertake processing on your behalf – are also going to represent you and your views on privacy as well.”

So how should companies maintain data governance and control arrangements of third-parties?

All contracts with third-parties should be revised to define the data processes, including:

 

  • How information is used, managed and protected;
  • How breaches are reported;
  • What are the customers’ rights;
  • Acting only as per documented instructions;
  • Agreement to not contract a sub-processor without prior approval; and
  • Returning or deleting all data at the end of the contract.

 

Not only do businesses need to ensure that the external firms follow through on the privacy commitments, they’re also required to know their vendors’ privacy policies and ascertain that they have appropriate security measures in line with data protection compliance.

It should be noted that a data breach occurring at a third party or caused by a vendor is a shared responsibility between the parties – the processor must notify the data controller of the breach, and the controller, in turn, is expected to report the incident to a GDPR regulator within 72 hours.

Furthermore, the controller is responsible for informing the data subjects, or customers, of the breach, where the DPO will act as the point of contact between the controller, the regulatory office and the customers.

 

According to Soha Systems, 63% of all data breaches can be linked directly or indirectly to third parties. Additionally, only 37% of controllers believe that they will be notified by the vendor if there was a breach of data.

 

However, less than 20% of companies feel confident in being able to report a breach within the stipulated time while it was discovered that only 45% of EU companies made an effort to report such incidents.

 

Solution tip: To avoid the heavy costs of a vendor data breach, it’s best to have a solid vendor risk management program with strong technology and clear policies and procedures. Detailed audit records and processes also help to catch any issues before they escalate into a breach.

 

  • Data Deletion and Minimization

 

According to Symantec’s State of European Privacy Report in 2016, 90% of organizations believe that deleting customer data will be a challenge for them in regards to GDPR compliance while 60% said they are not equipped with an existing system to delete the data.

As the GDPR dictates businesses from holding unnecessary data and storing data for long periods, companies were determining what data to keep and the data retention period. Since the regulation also provides data subjects the right to data erasure, organizations also need to find the best solutions for permanently removing personal data.

The issue is that some companies may not know where their data is stored within the organization, thus making it difficult to locate and delete the data. There’s also the problem of backups, so how are organizations expected to erase personal data that is “often scattered across multiple applications, locations, storage devices, and backups”?

 

 

Aside from data deletion, data anonymization and pseudonymization are data minimization techniques that are used by businesses to comply with the regulations.

Data that has been anonymized disables the data subjects from being identified, and is excluded from the GDPR regulation as it’s no longer considered as personal data.

On the other hand, data pseudonymization “replaces personal identifiers with non-identifying references or keys”, preventing the identification of the data subject without the key. But data processed using this method is still regulated under the GDPR as the data subject can be re-identified through additional information.

While companies are using these methods to protect their data assets, organizations must ensure that they still comply with the data purpose limitation in Article 5 of the GDPR.

 

Solution tip: Implement automated data discovery software or machine learning technologies that are able to keep track of all the data in the organization’s databases, data lakes and legacy systems. Carefully review if anonymized data is possible for the company’s data use before implementing any anonymization solution or automated erasure software.

 

  • Data Security

 

The COVID-19 pandemic brought many challenges to organizations, one of them being the rise of data breaches as remote working continues to be the norm for companies. In fact, the months between March and June 2020 recorded more than 470 data breaches, pushing CIOs, CISOs and other C-suites to strengthen their cyber security strategies.

Breaches not only indicate a lack of data security, whether on the controller or processor’s part, but can also lead to hefty GDPR fines of up to €20 million, or 4% of the company’s total global turnover.

Reputation damage and loss of customer confidence are other consequences of such incidents, which can be hard to rectify even after containing the breach, seeing as “57% of consumers don’t trust brands to use their data responsibly”.

From low employee awareness of cyber threats and lax online behavior to unsecured endpoints and external access, there are many security gaps that hackers can utilize to gain access to a company’s data. 

 

“Data security does not equal data privacy, but it is an integral part in achieving it.”

– Paige Bartley, Senior Research Analyst at S&P Global Market Intelligence,

Expert Interview: Paige Bartley on Data Privacy

 

CIOs are already focusing on maintaining system security while employee training is a topmost priority for 92% of C-suites, according to our findings.

 

Solution tip: Update policies regarding the access and handling of data when managing it externally, and increase training of employees on the new policies, online safety and rising cyber threats. Limit data access to only authorized personnel, and implement systems to detect illegal access.

 

How should companies stay GDPR-compliant?

 

Executive leadership is vital in ensuring the organization remains compliant with the regulations.

While data compliance and cyber security may be in the realm of the CDOs, CISOs and CIOs, all stakeholders that collect and use customer data should be involved – from marketing and sales to finance and operations – along with the assigned DPO.

Clear and detailed procedures must be established and periodically reviewed to ascertain that the processes continue to adhere to the GDPR. This not only includes the handling and use of the data, but also in answering the requests of data subjects exercising their rights.

Furthermore, organizations should demonstrate accountability and transparency in all processing activities, which extend to keeping records of risks and compliance progress, maintaining a strong data protection and breach response plan, and ensuring the continued compliance of external parties.

Although companies might lament over the obstacles and concerns of being GDPR-compliant, studies showed that among the businesses that have implemented their compliance processes, 74% of organizations say the GDPR has a beneficial impact on consumer trust while 73% believe the regulation has actually boosted their data security.

Overall, the GDPR is showing a positive effect on businesses, especially for companies that show they value the privacy of their customers.

Posted on

Online B2B Sales: How To Sell Better In The New Norm

The COVID-19 crisis brought unprecedented changes to the business world. And sales leaders in particular have to navigate paradigm shifts as companies move to preserve cash flow and reduce spending.

So how can you as a sales professional successfully close online B2B sales in this ‘new normal’? What are the best practices to sell remotely amid the pandemic?

Management Events checked with our sales managers across Europe for business-to-business (B2B) sales tips and advice on adapting to virtual selling and developing online strategies for better prospect engagement.


How has COVID-19 impacted your sales process?

Different sales managers have their own B2B sales techniques and routines, but all of them are in agreement that the outbreak has changed how they communicate with prospects and existing clients.

Knott: My sales process was not impacted because I have always been working over the phone or using video conferencing tools. But COVID-19 has, of course, affected the way of approaching and reaching the customers.

Werring: Our sales processes are definitely different from before. Generally, we see that we would need more meetings to close the deal, and the sales cycle takes longer than usual. Also, our concept in the Netherlands is based on face-to-face meetings, which is not possible for the meantime, so we had to change the way we sell – 100% virtual.

Komulainen also agreed with Werring’s statement on the longer sales cycle, noting that sales reps have to re-look at their communication strategy.

Komulainen: The base of my sales process has always been to find out the goals and ambitions of my customers. Then, together with the customer, we discuss whether cooperation with Management Events helps them reach their goals. Now, due to COVID-19, many companies have shifted their goals from growth to survival, and are a bit hesitant on new commitments. Hence, the sales cycles are longer and require more patience and understanding of the customer’s situation.

How have you adapted your sales approach to the current times?

The social and economic constraints of the pandemic are causing salesforces to quickly evolve their B2B sales approach to engage clients. And for Komulainen, although he understands that businesses are hesitant to spend at this time, “on the other hand, you have to be very assertive.”

Komulainen: Clients are very unsure, and they have every right to be. Some of them need a bit of extra convincing and help to make decisions. I try to find out whether clients are already looking to the future and trying to adapt to this new situation or if they are simply waiting for this storm to pass. For the ones that are trying to move forward, we can be of massive help.

Werring and Knott’s sales approaches also adapted to the current situation, leveraging on empathy and improved personal selling.

Werring: There are more meetings involved, and more empathic conversations about safety and family. I first try to understand how the client is doing personally, then understand how the company is doing, and the business in general. If all is good, then I will try to sell.

Knott: I have always been really personal with clients, but due to home office situations, my personal selling has increased even more.

Sales professionals who engage in personal selling focus more on helping clients to solve problems and find solutions for their pain points. In these times more than ever, prospects need to feel that you have their best interest in mind, and are not just looking to make a sale.

Knowing and addressing customer concerns give you the opportunity to diffuse any worries they may have, and a higher chance of them making a purchase decision.

Some companies are drastically impacted by the outbreak.

What is your strategy when contacting them about our services?

Knott: You have to approach them on a really personal level, and understand both their private and professional situations. See if and how we can still support them and offer our service.

Werring: You need to first show them compassion, and understand how they are affected business-wise and personally. Then you move towards helping them to improve and grow again, and how you and your company can assist them with that.

Komulainen: First, it’s key to find out just how they were impacted, where their focus is, and what their goals are, if they are at all hopeful about their future. We need to emphasize our key value driver – for us, it’s the quality of our events and business networking. We are still bringing in top delegates from the top companies in our market. If their services are relevant to the delegates at this moment or in the future, we offer a smooth path to direct discussions with these decision makers.

What are some of the biggest pros and cons of selling virtually?

While some sales reps have had difficulties in transitioning to remote selling, others took the change in stride. From a boost in productivity to interactive online presentations, virtual selling has become an important B2B sales skill.

Knott: The government may not allow physical meetups, but selling virtually has higher efficiency and simpler internationalization.

Werring: When conducting remote sales, you become much more efficient time-wise, as there is no need for traveling. Also, it’s easier to share your screen to show information, data and more with the clients.

Komulainen: Meeting virtually is much more efficient and structured. It’s so important to keep your camera on in order to keep your customer engaged. Also, you have different tools to share and visualize content. Some people like to draw, some show videos. You have so many options to choose from.

However, as with every sales strategy, there are both advantages and disadvantages of virtual B2B selling. And the essence of in-person meeting seems to be the most missed aspect of the new era of sales.

Knott: The core-competence of physical face-to-face meetings is gone, and there are no chances for extended networking and mingling, such as lunch or dinner, and talks by the coffee machine.

Komulainen: I miss being out, having a casual talk with a client in the lobby or while getting coffee. Meeting face-to-face is more personal and casual, you know. 

Werring: There is no real connection, making it hard to fully ‘feel’ somebody, and customers tend to get bored faster. There are also technical issues, like the camera not always working and such.

Objections are part and parcel of sales, and many businesses are using COVID-19 as their reason against spending on a service.

How do you handle this particular sales objection?

Komulainen: Goals and ambitions – that’s the key, in my opinion. If a company wants to achieve growth or build relationships during this trying time, today is always the best time to start.

Werring: In our concept, we always need to show a clear ROI and of course, in that sense, the costs precede the benefits. You need to make the client understand that, even in hard times, it’s not wrong to do the RIGHT investment!

Knott: First of all, dig deeper! What’s the objection: company regulations, budget cuts, staff cuts, and why? Even with the outbreak, life and business go on, and companies still need leads.

Instead of viewing it as the end of a lead, you should think of a sales objection as an opportunity to learn more about your client’s needs and a new way to effectively show the value of your product or service.

Werring:  Make the client realize that their workforce will be at home for the foreseeable future. And to keep them stimulated, an event works great, even though it’s virtual.

Komulainen: It’s not so much an objection towards us or other service providers, but more to their own business and self-belief. If we want to truly help them, we have to find out where the real problem lies. If the problem is lack of money coming in, or in other words, sales, we can help them same as always.

How do you think B2B customers are responding to online selling and virtual conferences?

Werring:  Great! Online sales definitely works, as we do most of our business remotely now. Virtual conferences also work – but they are generally less fun. However, to get connections and continue with developments and growth, they are definitely effective.

Komulainen: The initial shock has passed in most industries. The problem with virtual conferences is that there are so many of them. It seems that every other company decided to make their own webinars, and spam their customers and contacts with invitation to free webinars on different subjects. This created a sort of backlash. The quality and value of said webinars took a dive. I started hearing things like, “I do not want to take part in virtual webinars or conferences.”

But just like how companies are adapting differently to the consequences of the coronavirus, so too are the responses of B2B clients to virtual selling and events.

Knott: Every customer has a different opinion about going virtual. Some see the advantages and the higher efficiency of online events, and are happy to attend from home offices. On the other hand, others think that it doesn’t have the same value as a live conference, and compare us with standard webinars. 

So how can sales reps try to convince their clients on the value of their service?

Komulainen: The correct question to ask is, “Why?” They can tell you things like, “There’s no interaction between attendees” or “Low attendance and quality of attendees.” Then it’s easy to tell them how we have solved these issues at our virtual events.

What tools or working habits have been useful in helping you to get the sale remotely?

With lockdowns and movement restriction orders implemented throughout the countries, sales forces have to find alternative means of communication and selling.

Knott: Engagement sales method (ESM) tools are needed more than ever. We in DACH have always been selling over the phone or using video call tools, but Microsoft Teams made this a lot easier.

Werring:  I agree that ESM has been a valuable tool, which we developed for virtual selling a couple of years ago. Teams and Zoom are also useful in communicating with clients and getting the sale.

Komulainen: MS Teams is so helpful when it comes to selling. But I’m also experimenting taking walks during phone meetings. Short walks help to keep me energized during the days that involve a lot of sitting.

What common mistakes do you think salespeople are making during remote sales?

Werring:  Common mistakes would be forgetting about the whole COVID-19 situation, and starting to sell right away, instead of first understanding the client and the climate the client is in. Other mistakes are not dressing up for a meeting and pitching too much, instead of making it a dialog.

Knott: The mistake salespeople often make is feeling too laidback working from home, and not dressing up for the video calls. You need to dress to impress!

Komulainen: For me personally, it was essential to stop presenting and start selling. I think, as sales people, we are used to selling in our own way, but now we had to adapt very quickly and some mistakenly started presenting instead of selling. With virtual meetings, it’s more difficult to keep the customer engaged and intrigued, so we really have to be on our toes and keep focused.

What tips and advice would you give to salespeople to succeed in online selling?

Both Komulainen and Knott agreed that sales personnel need to get their basic preparations and materials ready for a successful virtual sales meeting.

Knott: Good preparation for meetings is vital. Make sure all the links you would like to share with the customer are ready, such as links to your sales materials on the enterprise service management and digital asset management platforms.

Komulainen: Have a clear structure to the meeting and inform it to the customer too. I like to close the agenda or the structure very firmly, such as “This is the agenda. Is this a good use of your time or should we make alterations to it before we start?”

Werring:  Dress to impress, and don’t forget the importance of small talks, especially in times like these. Keep the meetings dynamic and fun. Let the customer talk as much as you can allow, and keep the pace of the meeting high to make sure they won’t get bored.

Knott: It’s a good idea to warm up your calls by talking to a colleague to warm up your tongue. Also, dress up and smile so customers can hear and see the professionalism.

Komulainen: Keep the meeting efficient, and engage the customer. Ask the right questions and really listen. Salespeople are problem solvers of the best kind as we are here to help.

Posted on

Trend Micro: Securing The Pandemic-Disrupted Workplace

cyber security

The coronavirus is notably the singular cause behind many changes that have affected companies and sectors worldwide. And one area in particular that organizations are facing challenges in is cyber security.

Cyber crimes increased substantially amid the pandemic, with cyber criminals taking advantage of the crisis to attack businesses with malware, ransomware, and phishing emails. Due to the threats, business leaders are racing to patch recently uncovered vulnerabilities.

Trend Micro, a multinational cyber security software company, shares with Management Events how businesses can secure their systems in the current precarious landscape.

 

A Snippet of Trend Micro

Trend Micro was founded in 1988 developing antivirus software, but has evolved into a market leader in hybrid cloud security, network defense, endpoint security, and more.

Trusted by 45 of the top 50 global corporations and with over 500,000 businesses using their software, the Trend Micro Smart Protection Network is one of the most advanced threat intelligence networks in the world.

 

PRESSING SECURITY CONCERNS FOR ORGANIZATIONS

 

In the Trend Micro Security Predictions report for 2020, we tried to predict the changes that would shape the cyber security industry as we entered a new decade.

What we could not have anticipated was how the “new normal” — which would arise due to the COVID-19 pandemic — would affect the way we interact with the world.

For many people, working from home became not just an option, but a necessity as the pandemic forced organizations around the world to reconsider how and where they work. Unfortunately, the speed and urgency of the changes caught many businesses unprepared, leading to security gaps in both the home and the physical workplace.

Malicious actors took advantage of the situation by launching a slew of COVID-19-themed attacks using a diverse array of lures across a wide range of platforms, including emails, social media, malicious websites, and fake mobile apps. 

Video conferencing apps became a favorite target for cyber criminals as the need for effective communication led to increased usage. These attacks ranged from pranks such as Zoombombing to full-fledged campaigns involving malware bundled with app installers.

Threat actor groups relentlessly continued their campaigns. Some groups chose to expand their operations to new platforms and operating systems, while others built campaigns around seemingly outdated techniques or made use of malware types often thought to be harmless

Ransomware continued to be highly targeted in nature, with one high-profile group deciding to drop its public operations to concentrate on private campaigns. Some ransomware operators have also threatened to expose the data they stole from their victims to the public.

Microsoft ended its support for Windows 7 early in the year, while at the same time devoted more resources to fixing vulnerabilities. The company patched a record number of bugs in the first half of 2020, which also included a number of significant vulnerabilities such as CurveBall.

Several industrial internet of things (IIoT) vulnerabilities that exist in decades-old third party software components proved that there is a lack of standardization and safe coding guidelines when it comes to IIoT systems. Due to the large number and interconnectedness of the potentially impacted devices, it will be difficult to determine the impact of these bugs for the foreseeable future.

2020 has proven in many ways that the cyber security industry does not exist in a static bubble, but shifts and changes in accordance with and in response to the events of the world around it. In a year that has dramatically impacted most of our lives, we take a look at the most significant stories and trends to determine what has changed and what we can expect from the new normal.

Read the full report to get deeper insights into cyber threats and issues for the first half of 2020.

Posted on

Master Your Digital Leadership in Finance

Finance among organizational functions is unique in the sense that it spans all areas of a business. However, a new digital economic infrastructure and the tools to accompany it are being built with advancing digital technologies such as Cloud Computing, Internet of Things, Blockchain, Artificial Intelligence, and Robotic Process Automation (RPA). What this means for financial innovation is that rapidly evolving technology and the full realization of the value of data are the current drivers developing the digital economy.

 

Consequently, finance leaders must adopt an all-inclusive view of their transformation across the organization. The effective finance leader needs to remain up to date by ensuring that they are conversant with the trends in technology and identify how they apply to create or support the company’s sustainable competitive advantage.

Trends and What It Means to Businesses and C-suite

Thinking about popular innovative leaders, one would be hard-pressed to remember or find a CFO on a shortlist, with most generally, seeing the CFO as the proverbial bad cop, with a bias for short term top and bottom line, depriving the creatives in the enterprise of oxygen, and subsequently killing innovation.

 

Fortunately, in the digital era, the CFO should maintain focus on the value equation: less cost, more revenues, and more margin. Thus, the caricature of the nay-saying bean counter does not apply to a holistic CFO. The digital CFO understands that the right type of innovation will, in the midterm, lead to all of that.

 

“Assuring innovation is tied to value thinking. Assuring creativity is not equal to Russian roulette. True innovation ultimately leads to superior financial performance is a mantra of the modern CFO.”

– John Brahim

 

“Digital” encompasses a set of trends and opportunities that belongs to the C-Suite. It thus should not be viewed as in contradiction of the long-term strategic focus on innovation and or delivering on the next reporting period. The CFO, as the guardian of value thinking, has a vital role to play. Such as Investment Allocation, Risk Mitigation, and Sharpening benefits cases.

How to Manage Innovation and Change

Change is inevitable, and just as the famous quote by Heraclitus, a Greek philosopher, “The only constant in life is change.” Change affects us all, and we deal with each new change differently. There can be no innovation without change and vice versa.

“Make it tangible. Sure, innovation is about soft things like culture and freedom; however, sooner rather than later, it should shape up in concrete Journeys. The CFO can lead the way by focusing on 3 levers for innovation: automating the enterprise round 3, embracing analytics day to day, being digital as a way of life.”

As technology progresses and new solutions become available, the needs of financially vulnerable individuals or businesses need to be kept in mind. Players from various sectors can propel innovation effectively when they partner across sectors and keep the needs of financially vulnerable people at the center.

  1. Automating Enterprise Sequel 3

    Firstly, the hard part of the back office was automated. Softer operational processes closely followed this. Where thanks to a combination of Cloud, AI, and Visualization technologies, the third automation wave will go beyond mere operations and transform the tactical layers, augmenting those that orchestrate the enterprise.

  2. Embracing Analytics

    The past saw financial functions providing curated historical data to the enterprise. However, current trends show people clamoring for real, actionable, and predictive insights. Fortunately, enterprises only require two components to achieve this: the right tools to capture and analyze Big Data and Artificial Intelligence (AI) to deliver more contextual and human answers.

  3. Being Digital

    Taking an enterprise digital requires a lot. For starters, the enterprise’s mission, value proposition, and business model will be affected. It will be a series of journeys requiring a dissimilar culture, new skills, different governance, and a new way of working. The mission and way of working have to transform for the CFO to assure financial health, allocate assets rightly, and mitigate risks amid novel volatility.

Remaining Relevant in the Eyes of Your Stakeholders

From a financial perspective, we can deduce that innovation requires proper budgets and timeframes. Smart financial constraints and deadlines do not impede but accelerate creativity by fostering a sense of urgency and focus. As the CFO, you play a vital role by operating with independence and critical empathy.

Cloud ComputingThis translates to creating measured freedom from business-as-usual rules, especially when it relates to funding, contracting, hiring, and reporting. The company can expect significant breakthroughs provided the CFOs know how to exercise their levers to empower and encourage innovation by understanding which rules to relax and which to follow. In this sense, a holistic CFO can validate how ideas outside of the current business logic may be worth pursuing.

CFOs are often being asked by their CEOs to assist in enabling digital innovations in their companies. As the gatekeeper of a data-rooted, value-seeking business model, the opportunity for CFOs is not so much to play the role of a skeptic but rather to be the voice of reason. Similarly, because CFOs can logically relate innovation to key business drivers, they can also engage with the innovation teams as the individual guiding them to a “Yes.”

CFOs: learning from innovation-driven leadership

Brahim shares one of the first things that CFOs need to be inspired to formulate a digital mindset for their own basic processes. Going digital touches all classical financial processes, changing everything from core accounting and treasury management to fraud detection and KPI reporting.

 

Secondly, established CFOs should take cues from the new generation of digital leaders about more effective and efficient means of collaborating internally & externally. Understandably, changing one’s working style will significantly drag a leader out of their comfort zone than intellectually absorbing the intrinsic contents of the new digital journeys.

 

Thirdly, AI should pervade the entire enterprise. CFO’s who were not raised with this technology must be willing to get their hands dirty, learning how to apply AI in their daily play. On the positive side, this makes them a better role model whilst signaling to their team that nobody stays behind.

 

This is all easier said than done. Fortunately, Maistering’s platform, Master Collections, brings all of these together in an entirely new set of services. It offers a completely natural means for CFOs and other C-suite members to adopt a digital way of working. Unlike classical ERP applications, the platform adapts organically and does not require a heavy wall-to-wall implementation. Within weeks a CFO and her team will easily engage in digital or other innovative journeys using Master Collections.

 

Digital Transformation

 

The Immediate Future of Finance Function

The finance function is set to experience the biggest era of transformation. Requiring a balance of solid technical knowledge and data science, as well as a deep understanding of the business itself. Digital and AI innovation spread from the consumer to the enterprise world so that most experiments will start with sales and marketing functions.

 

However, there will be as many use cases in production, logistics, HR, and so on. Finance will be no exception, but like all others, will wrestle with its own strengths and weaknesses in culture, talent, practices, and assets. To a certain extent, the CFO will be catalyzed by her own ecosystem as the surrounding world of accounting, funding, collections, tax, and compliance is bracing for deep impact from AI themselves.

 

In the past, enterprises were shaped by processes. However, Brahim believes that the largest impact will undoubtedly originate from leader augmentation by the more practical AI and not the mythical deep stuff.  Thus, our century will experience enterprises shaped by leader orchestrated journeys.

 

““Augmenting leaders in how they orchestrate Journeys, taps into a formidable business case. Imagine all those digital and other Journeys that a CFO or her peers in the C-suite undertake, becoming faster, richer, and more impactful. There is simply no better business case in modern enterprise than that. Surprisingly enough, Master Collections is a first mover when it comes to “augmenting masters”, as we call enterprise leaders, on their Journeys.”

– John Brahim

 

Ultimately Brahim believes that competent CFOs know how to co-shape journeys, create processes beneficial to the entire business, and make others successful. Master Collections as a new category platform offers CFOs the perfect toolset to engage in digital journeys and naturally fosters the synergies with the C-suite peers and others that require guidance and empowerment from the digital CFO. This is where the future lies for the new digital CFO.

Posted on

Organizational Crisis Management: 7 Surprising Ways HR Leads Through a Crisis

Organizational trends point to an increase in the “invisible structure”; culture networks, employee learning abilities, core values, and projected identity that aids in solving previously unforeseen problems. Human resources are the arm of the organization that builds this invisible structure.

 

HR typically functions as a bridge between management and other employees. Yet, this influential department is not often regarded as a business partner, playing a vital role in the organization’s day-to-day running, particularly during a crisis. HR’s responsibility is more than just managing administration and service contracts. The article below expounds that in times of crisis, HR can play a decisive role in safeguarding the company’s success, and as such, it is about time for the rest of C-Suite to bring HR to the decision-making table.
connecting

1. People First

Being the people-focused arm of an organization, CHROs must place the safety, culture, protection, and mental health of the employees at the forefront. According to a KPMG International survey, HR executives prioritize employee experience (EX) as their focal point. Pathfinding HR¹ organizations were almost three times more likely to “strongly agree” that employee experience is a strategic priority for the entire organization. Furthermore, when asked about organizational strategies in place as regards EX, 75% of Pathfinding HR organizations had a system in place to design an EX that reflects and supports the customer experience.

 

¹KPMG defines “Pathfinding HR” as a confident group of HR executives, simultaneously focused on four discrete capabilities to chart their course to the future in a disrupted world: shaping the workforce of the future, nurturing a purpose driven culture, and designing a “consumer grade” employee experience, all through the use of evidence-based insights.

– KPMG International

 

COVID-19 struck impromptu, hitting hard and affecting all levels of businesses. Suddenly, CHROs must focus on employees’ health and well-being over the potential for denial of access or financial loss. Executing workforce adjustments will prevent high attrition levels.

 

Crunched numbers determine the most optimum methods to prevent the company from being overwhelmed. Deciding employee teams, non-intermittent or rotational work and shifts in location (home or office), number of employees that can work together, those who cannot, and prolonged absences. C-Suite and upper management must prioritize additional insurance coverage specifically designed to protect and support their people, intellectual property, and premises in the event of a crisis.

 

2. Talent Management and Engagement

The past few years have taught us that business agility is vital to the future of work. With increasing digitalization, globalization, and the newer generation entering the labor force, the faster a company can evolve alongside shifting consumer and employee engagement trends, the better equipped they are to survive in the long run.

 

Chances are everyone who works for you is aware of at least one website or has an app that gently nudges them to change employers. And if you are like most business leaders, you work hard to give them reasons to stay with your company every single day willingly. In the latest PwC’s Human Resources Technology Survey, technology investments and their effectiveness were explored, with the views of 600 HR and HR information technology (IT) leaders on six continents collected.

 

58% of these HR professionals informed that they had issues utilizing technology to find, attract, and retain talent. Companies spend $310 per employee per year on HR tech, yet 74% of companies surveyed still plan to boost spending on HR tech in 2020 to focus on pressing talent needs.

 

During a pandemic, HR plays another significant role that most do not get to think about, one of which is ensuring that employee emergency contacts are up to date. CHROs also take the lead by providing all employees with appropriate outlets for emotional or financial support. Supplementary training offered to develop and retain the best talents.

 

3. Leading with Candor (Communication & Support)

The golden hours of a crisis are the period in which decision making is at the most critical. During this period, CHROs are looked upon to trigger resources to communicate and respond efficiently across the company, responding to employees’ questions and concerns. Other employees typically place high expectations on C-level executives such as yourself for strength, reassurance, and leadership in turbulent times. It is essential to keep your people sufficiently informed.

Cloud Computing

One of the most critical tools for any successful crisis management approach is implementing a practical communications framework and access to dedicated numbers to help businesses respond to new information as they are available. Examples are special groups and channels via Facebook, WhatsApp, Telegram, or similar messaging platforms.

Contrary to generally accepted organization data privacy and security laws, a key factor is to ensure the chosen platform is externally controlled, especially in the event of a cyber-attack that forces a section or company-wide network shutdown. This preset mode of communication might very well be the only way to communicate with teams safely.

While only a small number of companies use incentives (30%) and gamification (20%) to lift adoption rates, these two practices were rated the most successful methods to combat low adoption. The two most common strategies—training and leadership communication—while important, should be delivered alongside these other tactics that make using digital technologies more enjoyable, even fun.

 

4. Establish a Crisis Management Team

Despite a business’s best efforts, encountering a crisis may be inevitable for many. During the formative stage, CHROs as strategic planners can bring people together to form a crisis management team to formulate policies and guidelines. The team will propose potential outcomes and crises that might arise and develop multiple contingency plans based on such situations.

 

Such as communicating efficiently and effectively with customers, employees, the media, and all other stakeholders. It is critical for businesses with a strong social media presence; you cannot afford to stay silent during this period. Meticulously crafted, frank communications will be essential to maintaining your company’s reputation. The style of communication, honesty, and, when suitable, messaging on how your company is aiding an affected community and employees is vital. Lastly, develop a Business Continuity Plan, where the CMT is in charge of outlining strategies to overcome business disruption.

 

5. Encourage training and new skills acquisition

training & skills acquisition
During a crisis, leaders often refer to past experiences and or a guidebook of sorts to aid their decision-making. However, there is no single playbook during this pandemic that managers can reference for accurate advice and responses on how to deal with the COVID-19 pandemic and its multiple disruptions across all business sectors. Since many HR leaders are accountable for guiding the overall workforce response to COVID-19, they must model a learning mentality and influence others to stay interested and open to learning.

 

In recent years, technology has dramatically automated the typical functions carried out by the HR department. Summarily, it became possible to activate online payroll transmission, record keeping, training, skill management, employment interviews, hiring, and compensations. HR professionals and employees alike must also flow with the current digitization trend, focusing on skill development.

 

HR takes the lead to develop and model an experimental culture and encourage other employees to “fail forward” to learn from tough choices quickly. This crisis can also be a chance for HR leaders who have labored in the past to create learning cultures in their organizations, as there may be less opposition to trial and error from performance-focused leaders.

 

6. Providing Data-Driven Views

There are no clear-cut answers or precedents in this pandemic. C-suite leaders expect CHROs to resolve problems such as rotating the workforce to work productively from home, keeping essential frontline workers safe, and managing large-scale virtual downsizing furloughs. All these while trying to protect health benefits.

To achieve this, CHROs, HR teams, managers, and business owners rely on various software, including an information system to assist, manage, and automate many of the administrative tasks to improve HR activities’ workflow.

Analyze, Strategize

According to the PwC’s Human Resources Technology Survey, HR leaders report robust business benefits from cloud-based HR systems that shape their technology portfolio’s core. 72% report having core HR applications in the cloud or are in the process of moving them. 56% from the KPMG International survey agree that preparing the workforce for Artificial Intelligence (AI) and related technologies is challenging. A further 66% (2 in 3 HR executives) believe that one of the ways CHROs can manage the impact of AI (and related technologies) on the workforce is to prioritize workforce upskilling. Particularly during a crisis when scale-downs or ramp-ups might be in order. HR can and should be providing a data-driven opinion to any actions.

 

7. Hastening the Future of Work

It is imperative to be aware that the crisis’s effects remain long after it has ended for employees, their families, organizations, and communities during recovery. At this stage, HR must have the necessary tools to educate employees and business leaders on identifying stress impacts and recommending they get help. Achievable by sending out memos or paving the way for intranet pages containing the necessary information about employee benefits and other employee-related policies and programs. Programs such as the Employee Assistance Program (EAP).

 

Remembering to look towards the future is a common challenge for CHRO leaders. Companies will benefit significantly from endorsing human-capital decisions that respond to the current crisis and future proof tomorrow.

 

The previous months of lockdown have seen most of the world’s workforce telecommuting from home. Consequently, revealing many cracks and opportunities in the current workforce policies. Fortunately, something good can come out of it. It is an excellent time to rethink the processes and accelerate the future of work — the flexible workplace, wider talent pool, training for remote work, concentrating on employee well-being, and redefining events for societal connections.

 

Conclusion

The pandemic has devastated businesses and workers alike, obliging CHROs at the epicenter to make tough choices regarding safety, downsizing, compensation, engagement, benefits, and business permanence. Most CHROs have switched to working from home full time for the first time. What with schools and daycare/kindergartens closed. Many employees with young children and dual-career families struggle with work-life integration.

 

HR’s responsibility is more than just managing administration and service contracts. In times of crisis, HR can play a decisive role in safeguarding a company’s success. They have to be bold and defensive in building effective, cohesive cultures of collaboration, insisting that employees prepare to deal with the unexpected and the challenges ahead, rather than merely refining skills from the past. It is not in the moment of crisis that HR should shine; it is before and afterward. Achievable by insisting the organization do the right things before the crisis hits.

Posted on

Endpoint Security and the Future of the Cyber Security Landscape

Establishing the Zero-Trust Cybersecurity Framework

In recent years, Cybersecurity has repeatedly been one of the leading anxieties for enterprises worldwide, and in 2020, that trend intensifies. Traditionally, it is easy to shirk the organization’s IT responsibilities and point fingers towards CIOs, CISOs, and the CTO. However, it would be imprudent not to acknowledge that most cybersecurity incidents have arisen due to employee negligence. As such, the culture of taking proactive security measures should be borne by the entire organization.

 

“Today, the only way to be sure your system is good enough from a security point of view is for the whole IT team to design everything with security in mind,” says Grossi. “It’s no longer okay to be only mobile first or cloud first; it’s got to be security first.”

– Piergiorgio Grossi (Former Chief Information (CIO) and Digital Transformation Officer at Italian motorcycle-maker Ducati)

 

A glance at today’s cybersecurity landscape

Cyber attacks alongside Deepfakes continue to increase year over year. According to the ISACA’s Global State of Cyber Security Survey—a survey of more than 2,000 information security professionals from more than 17 industries—looks at the threat landscape, the measures security professionals employ to keep their organizations safe, and key trends and themes in the practice of security.

The cybersecurity landscape presents a positive and negative outlook. On the positive side, at least 50% of fully or appropriately staffed teams are more confident in their abilities to respond to cyber threats. While on the negative side, 62% of survey participants agree that cybercrimes are severely under-reported, and 52% believe that it is very likely their enterprise will experience a cyber attack in the next 12 months. Nevertheless, Information security professionals still believe that real progress is being made against common threats.

The most common threat actors being Cyber Criminals (22%), Hackers (19%), Malicious Insiders (11%), Non-Malicious Insiders (10%), Nation-State Attackers (9%), and Hacktivists (8%). The most frequent attack methods being Social Engineering (15%), Advanced Persistent Threat (10%), Ransomware (9%), and Unpatched systems (9%). Other noteworthy methods are Distributed Denial of Service (DDoS) and Mobile Malware, especially via android.

Fortunately, Google is making more headway with its latest privacy-focused features and increased efforts toward security updates. Android 10 (Pie) introduced granular controls over app permissions, while the upcoming Android 11 (currently available as a developer preview) further conveys their commitment to improvements in security with the implementation of temporary one-time access, allowing an app to use, for example, your phone’s location or camera. Android 11 continues this security-focused expansion and uses biometrics (Face, Iris, and Fingerprint data) to authenticate apps and services. Android 11 will also support digital driver licenses and other identification documents.

The ISACA survey also shows that organizations that take longer to fill in their cybersecurity and related positions report an increase in cyber attacks. Enterprises that took less than 2 weeks experienced 26% more cyber-attacks this year. Those who took around three months experienced 35% more attacks this year. Those who took six months or more experienced 38% more attacks. While those who were or still finding it hard to fill the positions experienced 42% more cyber-attacks this year.

 

Why Endpoint Attacks Occur

There used to be a distinct difference between the inside and outside of an organization, with infrastructures possessing clearly defined roles and boundaries. Organizations would have offices with computers and servers running on-site, creating a physical firewall, and ensuring that data often never leaves the company.

However, with the rise in telecommuting, more employees were asked or forced to work from home where there is no apparent, easily guarded line that can keep all the data in and attackers out of the system.

Worse is that some organizations still have a legacy viewpoint of the boundaries. Combine that with the BYOD trend, and all these lead to an increasingly expanding frontline. Causing security personnel to deal with relatively easy to hack employee-owned devices. This is further compounded by the fact that most employees expect convenience—many opting to use free and popular services to bring their data outside the company and with them. The majority of these services are infamously insecure, as have been pointed out by several hacks lately.

One such cyber attack is the recent discovery of an additional six malicious Android apps (11 similarly malicious apps were discovered in July) that slipped through the Google Play Store’s safety net to plant malware on Android devices. Another phishing attack targeted government and security organizations, using a legitimate Box page with Microsoft 365 branding to trick the victims.

The attackers were careful to appear quite convincing. Botnets facilitated spam and malicious emails with sender names and domains from a legitimate third-party vendor, asking readers to view a sensitive financial document. Viewers who clicked the link were led through a series of pages till they landed on a phishing page, built to resemble the Office 365 login portal, where they were asked to log in with their corporate credentials.

According to the cybersecurity awareness and data analysis firm, CybSafe and data from the UK Information Commissioner’s Office (ICO), 90% of the 2376 cyber breaches reported to the ICO in 2019 were attributed to end-users’ errors. This was a significant increase from the years prior, with 61% in 2017 and 87% in 2018. The cybersecurity company reported phishing accounted for 45% of all reported cases, making them the primary cause in 2019 in the UK.

There is a general lack of public understanding around basic secure behavior, such as spotting fraudulent links and phishing emails, sending the wrong document to the wrong person, leaving a computer unlocked, or plugging in unidentified USB sticks. However, there are two sides to this human error issue.

  1. Passive Attacking: End-users and endpoints have become the primary targets for cyber attacks. This is because their behaviors and powerful devices are relatively easier to exploit, making them attractive targets. Security to most end-users is an untaught concept, and one they typically leave to the “experts.” Yet said experts are rarely the most communicative or most persuasive of tutors and thus, fail to communicate the pitfalls of not being security first effectively. Additionally, BYODs rarely include superior security, such as multifactor authentication (MFA), a system that can prevent the vast majority of data breaches by stopping unauthorized clients from accessing a corporate device. This all leads to the end-user becoming the weakest link, triggering a Supply Chain Attack.
  2. Increased IT Infrastructure Complexity: This second aspect encompasses the increasing complexity and distinctiveness of security tools. From intrusion detection, network monitoring, and encryption to security information and event management tools (SIEMs). Typically, more robust options are welcome; the issue is that all of these disparate tools need to be integrated effectively and correctly aligned to provide adequate and effective security. This also means that security teams have to know each tool, their uses, thresholds, and experience to create appropriate baselines. Unfortunately, teams are not trained well enough in the real world and most likely implement the tools with their default configurations. Doing this allows for an easier rollout but a risky and unsecured move, nonetheless. Such settings were predetermined by the manufacturer and basically put usability before all else.
 

“Though shocking, these statistics shouldn’t provoke a negative reaction. Employees of course pose a certain level of cyber risks to their employers, as seen in our findings thus far. Nevertheless, people also have an important role to play in helping to protect the companies they work for, and human cyber risk can almost always be significantly reduced by encouraging changes in staff cyber awareness, behavior, and culture.”

– Oz Alashe – (CEO and Founder at CybSafe)

 

Undoubtedly, cybersecurity has dramatically changed, and cybersecurity teams’ capabilities are being stretched past their limits. Fundamentally brought on by a ballooning attack surface blended with ill-informed and inappropriate consequential end-user behavior floated by some organizations that refuse to take security seriously.

 

Endpoint cybersecurity threats

Endpoint security is a critical aspect of the cybersecurity landscape, and it’s becoming increasingly important as the nature of work evolves. With more devices connecting to networks than ever before, from laptops and smartphones to IoT devices, the number of potential entry points for endpoint cyber security threats has multiplied. This makes endpoint cyber security a vital component of any comprehensive security strategy.

Endpoint cyber security threats are diverse and constantly evolving. They include malware, ransomware, phishing attacks, and zero-day exploits, among others. These threats can compromise individual devices, and from there, gain access to the broader network, leading to data breaches or system disruptions.

Malware and Ransomware: Malware is a broad term that encompasses various types of malicious software, including viruses, worms, and Trojans. Ransomware, a type of malware, encrypts a victim’s files and demands a ransom to restore access. These threats can infiltrate endpoints through malicious email attachments, infected software downloads, or malicious websites.

Phishing Attacks: Phishing attacks often come in the form of deceptive emails that trick users into revealing sensitive information, such as passwords or credit card numbers. They can also involve convincing users to click on a link or download an attachment that installs malware on their device.

Zero-Day Exploits: These are attacks that take advantage of software vulnerabilities that are unknown to the software vendor. Because these vulnerabilities haven’t been patched, they provide an open door for hackers to infiltrate systems and networks.

Advanced Persistent Threats (APTs): APTs are complex, stealthy threats in which an unauthorized user gains access to a network and remains undetected for a prolonged period. These threats are often state-sponsored and aim to steal information or disrupt operations.

To combat these threats, organizations need to adopt a multi-layered approach to endpoint security. This includes the use of antivirus and anti-malware solutions, firewalls, intrusion prevention systems, and endpoint detection and response (EDR) technologies. Additionally, organizations should regularly patch and update software to fix known vulnerabilities, and educate employees about safe online practices to prevent phishing and other user-targeted attacks.

 

The Future of the Cyber Security Landscape

The evolution of large-scale breaches symbolizes a growing trend of security violations both in numbers and their gravity. Data breaches recurrently expose sensitive information that often leaves users at risk for identity theft, ruin businesses’ reputations, and leave businesses liable for compliance violations. Cyber Observer, holistic cybersecurity management, and awareness solutions predict that damages from cyber crimes are projected to reach $6 trillion annually by 2021.

In other words, as enterprises gradually emerge from the current pandemic, we expect to see a surge in new demands. Reacting to these will require CIOs to formulate strategies based on two structural principles; understanding what customers need in a transforming landscape and leveraging technology to respond to these challenges in ways that acknowledge scope, cost, and scale objectives.

It is virtually impossible to write about the cybersecurity landscape’s future without citing Artificial intelligence (AI) and its role in securing endpoints. AI has existed for quite some time, and its use in our daily lives has become so common that we hardly ever stop to really think about it. From “Weak” AI programs such as “AlphaGo” developed by Goggle DeepMind that combined advanced search tree with deep neural networks, to Strong AI and machine learning systems used in flying Drones, Google Nest, and Tesla’s Autopilot. CIOs will carry on utilizing AI in various fields within cybersecurity. If anything, but to combat the numbers of attackers misusing AI and machine learning.

Looking to the future, the potential for new threat classes remains; ubiquitous and non-discriminatory in nature and to which there are currently no known catch-all countermeasures. Intrinsically, meticulous observations on malware features, abnormal acts, attackers’ attributes, and machine learning-based AI algorithms empower the defenders to deal with cyber threats, and in some cases, actually, go on offense. Regrettably, such observations also provide the attackers’ chances to invent novel attack techniques. Particularly as the risk of inputting false data and many other unsolved errors are relatively high in AI, defenders must always stay alert.

 

10 Simple Steps to Protect Your Business

Today, homeowners go beyond the typical door locks and automatic lights to a fully integrated security system that can prevent attacks and detect and respond to an intrusion and even accidents like a fire. Similarly, a business should deploy a multilayered cybersecurity strategy, one that includes.

Prevention: Firewalls, Anti-virus, Anti-malware, Password Management, Cybersecurity Awareness Training

Detection: SIEM, IDS, Threat Intelligence, and Log Monitoring

Response: 24/7 SOC Monitoring Response, Automated Threat Remediation, and Forensic Investigation.

These are all great tools, but in reality, not all businesses can afford top of the line and often proprietary security suites. Fortunately, you or businesses do not need to invest endlessly in new security tools to improve and elevate your current Cybersecurity posture and awareness for the reason that 80% of data breaches can be prevented with the following basic actions.

  1. Patching
  2. Regular vulnerability assessments
  3. Institute end-user security awareness
  4. Ensuring third-party vendor compliance
  5. Endpoint Detection and Response (EDR)
  6. Limiting access to your most valuable data
  7. Securing mobile devices and BYOD devices
  8. Proper device and or software configurations
  9. Conduct employee security awareness training
  10. Develop cyber breach prevention, detection, and response plan
 

Final Thoughts

Improving endpoint cyber security needs to be a top priority in 2020 and the foreseeable future. The border-less and seemingly non-discriminatory nature of cyber-attacks means it is of imperative importance that the cybersecurity industry shares their insights and work together to protect themselves and the wider population.

In today’s connected world, a breach of one organization can compromise an entire supply chain. Spelling disaster for businesses, eroding public trust and opinions, whilst leaving them in financial collapse, particularly with the General Data Protection Regulation (GDPR) in the EU. It is up to the legitimate security community to learn from each other, sharing what works and what does not. Most importantly, we all need to identify where to improve and ensure we leave no one behind.

Posted on

Aki Levänen: Is A SIEM Necessary?

From time to time, you hear comments in security discussions that “Security Information & Event Management (SIEM) is dead” or that it does not provide sufficient benefit in terms of input to detect and handle security incidents. The advocate may have his own agenda behind his opening: replacing SIEM with another product or experience in his own operating environment where there has been no need for SIEM or has been perceived as useless.

 

However, without taking an immediate opinion on the necessity or unnecessariness of SIEM, the matter can be considered from a few angles. After reflection, based on these thoughts, the reader can think for themselves whether SIEM is necessary and what it might offer me. What does SIEM actually offer and for what purpose? Where is SIEM good and for what purpose and need may better tools be offered? Whose need is being talked about in any context: the organization itself, the Security Operation Center (SOC), or someone else?

 

Investing in collecting logs

 

This blog post focuses more on observation, for example, the National Institute of Standards and Technology, the NIST cybersecurity framework Detect section, and what SIEM as a tool in that context can provide. It is true that from the point of view of collecting logs for the SIEM implementation, you have to invest in it and the workload can be big. The starting point for planning is to know the requirements for the operation and to think about the log policy, which creates the basis for technical supervision. Based on this, one can make an architecture as well as think about what is collected, from where and how. After all, it is not necessary to gather everything in one place, but you can even utilize the analytics in the cloud and pass the events to the person handling them, e.g. SOC, instead of building them yourself in SIEM. In reality, some sort of SIEM or data lake in the cloud is in the background.

 

User accounts and workstations are most often invaded in organizations

 

The most common way is to email the user with an attachment or link to access the workstation or email account, often O365. From the point of view of implementing the observation, I would take advantage of the security features of Microsoft’s O365 e-mail service, for example, instead of collecting data in my own SIEM and building alerts. At the workstations, this is partly the same, but can we investigate what has happened in more detail if necessary? Many security systems do not provide sufficiently detailed information about events and these could be supplemented, for example, by using the Windows system monitor (Sysmon) to collect more detailed information. This data can and should be collected in SIEM to support the analysis. Of course, newer Endpoint Detection and Response (EDR) tools collect information and logs from the vendor’s cloud services that can be alerted.

 

For whom is snapshot information most useful?

 

The word snapshot comes across in every security conversation with organizations. What it is and what it contains varies almost every time. It is often discussed that one should have access to SIEM and get different views and snapshots of technical events. Now, the essential question is, to whom is this level of information relevant? For SOC, yes, definitely support analysis and for the organization’s technical staff to understand events and even provide information for proactive action. The security manager can look at the situation, but often the discussion is in the direction of management, for which SIEM does not provide direct support. At the management level, that information is already much less useful, as the discussion often revolves around risks and events. Yes, these can be formed on the basis of SIEM data by analyzing and making security deviations and describing what should be able to be developed from the point of view of detection capability. This view is more understandable to management and can be discussed, remembering that observation is only one aspect of the whole.

 

Security event management is a necessary extension to observation and a requirement in all frameworks

 

SIEM elevates the events that are collected in the event management system. These are analyzed and security breaches are created, often in a separate ticketing system. These are used to communicate with the various parties involved and to record the measures taken, in which case the activities must also be documented at the same time. The ticketing system usually has built-in integration between actors or portal views. Naturally, various means of communication between the people handling the event are used as support. SIEM does not offer such, although some kind of event flow has been modeled for them as well.

 

The latest in this entity is the SOAR (Security Orchestration, Analysis and Response) system. SOAR acts as a collection system, collecting alerts, ticketing, portals, and also automating SOC operations through use cases. SIEM is not directly replaced by SOAR, but analysis and data collection must take place somewhere in the background of SOAR. Automation sounds appealing to many, but already requires moderately good maturity in handling and responding to security incidents.

 

Log collection and monitoring requirements are included in every information security framework

 

From a compliance point of view, the EU-GDPR has been the most recently highlighted, where the processing of personal data must be traceable from a control point of view. Log collection and monitoring requirements are included in every information security framework. In this way, these control requirements must be able to be solved in IT environments and also in production environments (OT / ICS). Especially in multi-vendor environments, IT vendors do take care of management compliance, but does it meet all the requirements for the organization itself? Most likely, these do not monitor the use of the organization’s own services or do not react to anomalies in the use of the service, but a separate security service, the SOC service, must be purchased. In this context, it may be quite justified to build SIEM itself and to establish controls for both management and operation of all relevant information systems.

 

SIEM is not dead

 

In practice, control solutions as current implementations are a kind of Hybrid implementations instead of a fully centralized SIEM. SIEM is not dead, and it is a very key component in information security control. How control solutions start to evolve is largely dependent on the current state of the organization, operational requirements and development investments. As with navigation, you must first know where it is so that you can move on to the next tick or, in organizational terms, to develop information security. Systems are needed to support analysis to produce information. Based on this information, it is possible to react automatically or by people according to pre-agreed or applied measures and to ensure the continuity of the organization’s activities in information security events.