Given increased geopolitical tensions and economic uncertainty in Europe, cyber-attacks are top of mind for legislators. The Russia-Ukraine war has brought attention to the devastating impact malicious threat actors can impose on critical infrastructure.
At a recent presentation at Carnegie Mellon University, CISA Director Jen Easterly called for a transformative shift to require the technology industry to infuse security into their product design. In her speech, Easterly defended her position, explaining how technology manufacturers have normalized products to be released with “cyber defects” and how we cannot blame technology customers targeted by adversaries. She emphasized the risk of poorly securitized products is more significant than the alleged espionage from the Chinese spy balloon incident. Shifting security responsibility on software developers is a commendable but lofty goal. We believe the solution is a bit more nuanced and requires collaboration. Reform is needed by both software developers and consumers in tandem. Software developers need to embrace standards such as market differentiators, and consumers need to practice basic cyber hygiene to strengthen their cybersecurity posture and not be considered negligent users.
Axio’s VP of Insurance, Peter Hawley, shares the latest trends and insights on cyber insurance. With 20 years in the market and a focus on cyber insurance for the better part of the past decade, Hawley has seen the industry and threat landscape change dramatically. Here, he covers some cyber insurance basics for anyone who is exploring purchasing a policy for their organization.
A few years before the pandemic, Harvard Business Review published an article stating that CFOs don’t care enough about cybersecurity. Today, the article serves as a milestone dividing the old mentality with our new reality these past two years. Since Covid, a new global threat landscape has materialized, and the notion of “it won’t happen to me” has been thrown out the window. Adversaries want to spy, steal, and sabotage data and critical assets. Everyone is a target. And these days, CFOs must understand cyber exposure with the same level of detail as the board of directors’ audit committee. CFOs need to whizz past the technical complexity of understanding cybersecurity defense and dive deep into risk mitigation in financial terms. Taking the culture of bits and bytes and translating it into financial language often begins by asking these critical questions to the CISO, such as:
On a recent earnings call, Meta CEO Mark Zuckerberg told investors how well the company would operate with a reduced headcount. “We’re going to be more proactive about cutting projects that aren’t performing or may no longer be crucial,” Zuckerberg said. He explained, “my focus is on increasing efficiency of how we execute our top priorities.” In the past quarter, Meta has reduced its headcount by over 10K employees as part of this strategic shift to stay operationally lean.
Cyber risk quantification (CRQ) has earned a bad reputation with many CISOs. Delays and drama suffered by using antiquated legacy methods have resulted in skepticism and doubt about its necessity. Many cybersecurity professionals tell us communicating cybersecurity in dollars and cents is just not mainstream yet. Yet understanding the financial consequences of cybersecurity events is no longer optional. The term “cyber risk quantification” is becoming prominent in many executive-level conversations centered around aligning business risk reduction with cybersecurity initiatives.
As the global elite gathered in early 2023 at Davos, the World Economic Forum released its Cybersecurity Outlook 2023 report. The report’s main theme emphasizes how geopolitical stability exacerbates the risk of catastrophic cyber-attacks. These are the kinds of attacks (often low-frequency, yet high-impact in nature) that are the focal point of Axio’s continuous cyber risk methodology. Continuous cyber risk management emphasizes how the threat of cyber-attacks is constantly evolving. We have all seen how new vulnerabilities and attack methods are constantly being discovered, and attackers are becoming more sophisticated. To effectively protect against these threats, organizations must continuously assess their risk and take more advanced steps to mitigate it. This includes regularly reviewing and updating security policies, implementing security controls, using cyber risk quantification, and monitoring for potential attacks. Once implemented, continuous risk management helps organizations comply with regulations and industry standards and to protect sensitive information.
Cybersecurity leaders are preparing for a rude budget awakening in 2023. The problem is multi-faceted. First, cyber-attacks are continuing to disrupt services and infrastructure with increasing velocity and impact. Secondly, the world is facing more economic uncertainty. Looming geopolitical tensions are now affecting physical and financial supply chains. Gone are the days of receiving a blank check for your cybersecurity program. Today, your team’s needs are treated more like operating expenses that need to be justified rather than necessary long-term capitalized improvements.