Cyber threats and risks for companies Managing cyber risks in an interconnected world Roman Chaplygin Cyber risks: A severe and present danger every day we meet cyber security news Public company in Poland • Organized cyber attack related to electronic commerce • Ineffective procedures for attack detection and incident response PwC Cyber risks: A severe and present danger every day we meet cyber security news PwC Cyber risks: A severe and present danger everything is under attack PwC • Government agency • Media • Energy • Retail • Power & utilities • Agriculture • Metal & mining • Banking & finance • Insurance • Private equity • Oil & gas • Telecommunications • Manufacturing Cyber risks become Business risks because they directly impact on the business TOP-10 threat for business growing PwC Banking CEO Survey 2014 PwC TOP-5 unlikely issue WEF Global Risks 2014 Report Incidents and financial impacts continue to soar and this is just an iceberg tip Some companies doesn’t disclose their incidents and many others don’t know about them PwC Incidents and financial impacts continue to grow Larger companies detect more incidents and they are more interesting to attack Small companies have less resources to detect attacks large companies are more attractive PwC 5% 64% 44% Incidents and financial impacts continue to grow Incidents are more costly to large organizations The annual cost of cybercrime to the global economy ranges from $375 billion to as much as $575 billion PwC Incidents and financial impacts continue to grow large companies have to spend more for defense While big corporations may have the expertise and resources to build a sophisticated cybersecurity fusion center that enables sharing of threat intelligence and response techniques, that is not practical for smaller firms. But they can obtain the same benefits through managed security services. Another option to address risks might be purchase of cyber insurance. PwC Nation-states, hackers, and organized crime groups are the cybersecurity villains that everybody loves to hate Employees are the mostcited culprits of incidents That’s not to say that all employees exhibit malicious behavior. In many cases, they may unwittingly compromise data through loss of mobile devices or targeted phishing schemes. PwC Nation-states, hackers, and organized crime groups are the cybersecurity villains that everybody loves to hate The percentage of incidents attributed to current and former service providers, consultants, and contractors increased to 18% and 15%, respectively, in 2014. PwC Nation-states, hackers, and organized crime groups are the cybersecurity villains that everybody loves to hate … it is easier, cheaper, and quicker to steal IP and trade secrets than to develop capabilities themselves. PwC Nation-states, hackers, and organized crime groups are the cybersecurity villains that everybody loves to hate Organized crime groups are typically motivated by financial gain. A successful cyber attack can net millions of payment card records that can be quickly monetized. In addition to credit and debit card data, these criminals increasingly target patient health care data or other personally identified information that has considerable value in the underworld of information resellers. PwC Nation-states, hackers, and organized crime groups are the cybersecurity villains that everybody loves to hate 59% of respondents say their organizations’ executives are worried about government surveillance PwC As incidents rise, security spending falls many organizations struggle to understand how much to spend on security and how to determine the return on investments The average information security budget dipped to $4.1 million, down 4% over last year. Security spending remains stalled at only 3.8% of the overall IT budget. PwC As incidents rise, security spending falls at the same time, few organizations are aware about the value of their risks, and counted them PwC As incidents rise, security spending falls so how to spend the available budget PwC PwC Prevent Protect As incidents rise, security spending falls so how to spend the available budget PwC PwC Detect Respond Security practices must keep pace with constantly evolving threats and security requirements Security tools are not enough, often the proper organization of cyber security processes is also very important: Only 49% of respondents say their organization has a crossorganizational team that regularly convenes to discuss, coordinate, and communicate information security issues. It also will require that the C-suite and Board be directly involved. • correlation of business and cyber security goals and objectives • proper security management with business involvement • vendor management and thirdparty assurance Only 50% perform risk assessments on thirdparty vendors, and just 50% have conducted an inventory of all third parties that handle personal data of employees and customers. Just over half (54%) of respondents say they have a formal policy requiring third parties to comply with their privacy policies. PwC Security practices must keep pace with constantly evolving threats and security requirements At most organizations, the Board of Directors does not participate in key information security activities PwC Gains in select security initiatives survey respondents are starting to see the value of working with others PwC Gains in select security initiatives evolving from security to cyber risk management PwC How PwC helps clients manage modern cyber risks wide range of services adaptable for your business Industry and sector aligned solutions Align with the business Prioritize investments, allocate resources, and align security capabilities with the strategic imperatives and initiatives of the organization. Strategy, Governance & Management Sustainable Emerging Technologies Security & Market Trends Behaviours Manage risk and regulations Efficiently and effectively identify, evaluate and manage risk to the business while addressing the evolving regulatory requirements. Secure by design Security Security Architecture & Strategy Services Adapt to the future Assess the opportunities and security related risks of new technology adoption and dynamically changing business models. We combine our industry specific experience and perspectives to address relevant trends, challenges and opportunities our clients face in their industry and the markets they serve. Cyber Risk & Compliance Crisis Management Response Create sustainable security solutions to provide foundational capabilities and operational discipline. Threat, Security Intelligence & Governance and Vulnerability Management Compliance Strategy through Execution --- + --Attest & Assure Address threats and weaknesses Anticipate changes in the risk landscape through situational awareness of the internal and external factors impacting the business ecosystem. Enable secure access Identity & Cyber Threat Access Assessment Management Provide integrated and secure processes, services, and infrastructure to enable appropriate controls over access to critical systems and assets. Incident & Anticipate and respond to security crises Technology Crisis Management Plan, detect, investigate, and react timely and thoroughly to security incidents, breaches and compromises. Business led approach – diverse capabilities We leverage and integrate our business, technical, regulatory, analytical, and investigative knowledge and know-how to deliver actionable and sustainable solutions. PwC Safeguard critical assets Information & Privacy Protection Identify, prioritize, and protect sensitive or high value business assets. How PwC helps clients manage modern cyber risks high quality and professionalism 180,000 38,000 PwC staff worldwide PwC consultants worldwide PwC applies its local and global experience and resources equally to create value for clients when carrying out diverse projects, ranging from strategy development to implementation. Leader in IT-enabled business transformation Forrester, 3Q 2012 PwC 9,600 2,000 PwC IT consultants worldwide PwC Cyber security consultants worldwide Our global network of firms includes 776 offices in 158 countries worldwide PwC has broad experience in providing consulting services to universities and higher educational institutions Leader in business consulting IDC Marketscape, 2012 PwC CEE has a highly talented pool of certified Cyber security consulting staff with a full range of skills: CISA – 39 people CISM– 7 people CRISC – 5 people CISSP – 4 peopl ISO 27001– 12 people and others Thank you for your attention! Roman Chaplygin Director, Risk Assurance, Information Security Services, PwC Tel: +7 (495) 967 6056 Mob: +7 (903) 272 1620 E-mail: [email protected] www.pwc.ru/cybersecurity This publication has been prepared for general guidance on matters of interest only, and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice. No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, PwC Russia, its members, employees and agents do not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. © 2014 PricewaterhouseCoopers Russia B.V. All rights reserved. PwC refers to PricewaterhouseCoopers Russia B.V. or, as the context requires, other member firms of PricewaterhouseCoopers International Limited, each of which is a separate legal entity. PwC Russia (www.pwc.ru) provides industry-focused assurance, tax, legal and business consulting services. Over 2,600 professionals working in PwC offices in Moscow, St Petersburg, Ekaterinburg, Kazan, Novosibirsk, Rostov-on-Don, Krasnodar, Voronezh, Yuzhno-Sakhalinsk and Vladikavkaz share their thinking, experience and solutions to develop fresh perspectives and practical advice for our clients. The global network of PwC firms brings together more than 184,000 people in 157 countries. "PwC" is the brand under which member firms of PricewaterhouseCoopers International Limited (PwCIL) operate and provide services. "PwC Russia" refers to PwCIL member-firms operating in Russia.
© Copyright 2024