• First Reference
  • About us
  • Contact us
  • Blog Signup 📨

First Reference Talks

Discussions on Human Resources, Employment Law, Payroll and Internal Controls

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies
You are here: Home / Business / My cyber confession

By Norman D. Marks, CPA, CRMA | 4 Minutes Read June 6, 2018

My cyber confession

With cyber security issues on the rise, it is not possible for an auditor to say that information security these days is either ‘effective’ or ‘adequate’.

cyber
Image: www.mytechteam.net

Before I confess, I want to share a recent and valuable report from Verizon. Their 2018 Data Breach Investigations Report has a depth of valuable information that merits the attention of every practitioner.
The Summary of Findings includes these observations:

  • 73% of breaches in the last year (of which Verizon is aware) were perpetrated by outsiders, while 28% involved internal actors
  • 50% were carried out by organized criminal groups
  • 12% involved actors identified as nation-state or state-affiliated
  • 58% of the victims were small businesses
  • 24% of breaches affected healthcare organizations
  • 76% were financially motivated
  • 68% took months or longer to be discovered

The extensive report analyzes breaches by type as well as by industry sector.
Another report that merits our attention is PwC’s The Global State of Information Security Report 2018. PwC has different numbers about who is responsible for security incidents, saying that 30% are from current employees, 28% from former employees, 26% from unknown hackers, 23% from competitors, and 20% from current third parties.
I tend to believe more in the Verizon report (just a feeling rather than being based on any data).
The only surprise for me in the PwC report is the assertion that competitors are the source of 23% of security incidents.
I like and recommend a McKinsey article, A new posture for cybersecurity in a networked world.
It has both useful information and excellent recommendations.

  • 75 percent of experts consider cybersecurity to be a top priority. That’s true even of industries like banking and automotive, which one might think would be preoccupied with other enormous risks that have emerged in recent years.
  • But while awareness is building, so is confusion. Executives are overwhelmed by the challenge. Only 16 percent say their companies are well prepared to deal with cyberrisk. The threat is only getting worse, as growth in most industries depends on new technology, such as artificial intelligence, advanced analytics, and the Internet of Things (IoT), that will bring all kinds of benefits but also expose companies and their customers to new kinds of cyberrisk, arriving in new ways.
  • A global insurance company’s experience indicates the potential. It budgeted $70 million for a comprehensive cybersecurity program. One year later, only a fraction of the planned measures had been implemented. Business units had put pressure on the IT department to prioritize changes they favored, such as a sales campaign and some new reports, at the expense of security measures, such as email encryption and multifactor authentication. The business units also took issue with the restrictions that came with cybersecurity measures, such as the extra efforts that went into data-loss prevention, and limitations on the use of third-party vendors in critical areas.
  • The US government has identified cybersecurity as “one of the most serious economic and national security challenges we face as a nation.”1Worldwide, the threat from cyberattacks is growing both in numbers and intensity. Consider these figures: some companies are investing up to $500 million on cybersecurity; worldwide, more than 100 billion lines of code are created annually. Many companies report thousands of attacks every month, ranging from the trivial to the extremely serious. Several billion data sets are breached annually. Every year, hackers produce some 120 million new variants of malware.
  • …despite all the new defenses, companies still need about 99 days on average to detect a covert attack.

Their recommendations include:

  • Cyberrisk needs to be treated as a risk-management issue, not an IT problem.
  • Companies must address cyberrisk in a business context.

The only problem I have is that McKinsey continues the traditional approach of assessing risk to information assets rather than to enterprise objectives.
Now to my confession.
In all my years as an IT auditor and then a CAE, I cannot recall ever assessing information security as being ‘adequate’ or ‘effective’.
There has always been at least one issue that was significant.
For example, I remember that one company where I was responsible for IT auditing relied on security software and mechanisms provided by HP for their HP3000 computers and Image database systems.
The vendor had told management that their systems were secure.
I didn’t think so and met with the CIO to share my views. His response was that I didn’t have evidence that was persuasive for him – given the assurance he had received from HP.
I asked for and received his permission to try to ‘hack’ the system myself. I would do so without any special knowledge, just access to a business user’s laptop (mine).
A week or so later, I showed him a list of userids and passwords I had obtained. I had found one weak point and from there navigated my way to a security file.IT
Why share this confession?
I don’t think it is possible for any auditor ever to say that information security these days is either ‘effective’ or ‘adequate’.
The best they can say is that it appears reasonable.
Reporting that it complies with a standard or is consistent with guidance in a framework doesn’t work for me.
It would not satisfy me if I was on the board.
Does this mean that we should give up auditing information security and the management of cyber risk?
Not at all.
But we should do so with eyes wide open.
We should recognize the limitations of our knowledge, tools, and techniques and the likelihood that hackers have new techniques that are unknown both to auditors and management.
We should ask management whether they believe that the risk to the organization from a breach is at acceptable levels and why.
I would be highly skeptical if they said everything was under control.
Then the key is to see if they have thought everything through – all facets: prevention, detection, and response – and that the risk assessment is based on the effect on enterprise objectives.
I welcome your comments.

  • About
  • Latest Posts
Norman D. Marks, CPA, CRMA
Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However,he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.
Latest posts by Norman D. Marks, CPA, CRMA (see all)
  • Twitter and risk - January 18, 2023
  • When the board insists on a list of the top risks - December 9, 2022
  • The greatest risk and the greatest asset - November 25, 2022

Article by Norman D. Marks, CPA, CRMA / Business, Information Technology, Privacy / Breaches due to malware or spyware, cyber, cyber attack, cyber risk assessment, cyber security, cyber threat, cybersecurity risks, IT Audit, IT auditing, IT risk assessment, malware

Share with a friend or colleague

Get the Latest Posts in your Inbox for Free!

Electronic monitoring

About Norman D. Marks, CPA, CRMA

Norman has led large and small internal audit departments, been the Chief Risk Officer and Chief Compliance Officer, and managed IT security and governance functions.

He retired in early 2013. However, he still blogs, writes, trains, and speaks – and mentors individuals and organizations when he can.

Footer

About us

Established in 1995, First Reference is the leading publisher of up to date, practical and authoritative HR compliance and policy databases that are essential to ensure organizations meet their due diligence and duty of care requirements.

First Reference Talks

  • Home
  • About
  • Archives
  • Resources
  • Buy Policies

Main Menu

  • About First Reference
  • Resources
  • Contact us
  • 1 800 750 8175

Stay Connected

  • Facebook
  • LinkedIn
  • Twitter
  • YouTube

We welcome your comments on our blog articles. However, we do not respond to specific legal questions in this space.
We do not provide any form of legal advice or legal opinion. Please consult a lawyer in your jurisdiction or try one of our products.


Copyright © 2009 - 2023 · First Reference Inc. · All Rights Reserved
Legal and Copyright Notices · Publisher's Disclaimer · Privacy Policy · Accessibility Policy