Digital Australia: A Cyber Security Culture

Tackling Talent Gap through Cyber Security Skills and Training

When adopting robust cyber security measures, Australian organisations must support workforce training. A company’s internal processes and workforce are the last lines of defence in protecting its business from cyber security threats. Naturally, employees make mistakes. Only adequate workforce training will help a company to put a cyber security incident response plan in place, which can help improve the habits and behaviours of staff and create a sense of shared accountability in keeping a business secure. It educates staff how to recognise, avoid, report, remove, and recover from an attack.

Cyber security is continuously evolving. Regular training keeps everyone up to date, which could be the difference whether a criminal is able to access your money or data.

Australian Government and Industries Partnering Up for Cyber Security Success

In November 2022, 18 projects have been awarded funding to improve the quality, quantity, and diversity of Australia’s cyber security workforce. In total, up to $25.4 Million AUD was awarded to address barriers to entry, and to improve the state of Australia’s cyber security workforce.

Boosting the participation of women, First Nations Australians, people in regional and remote areas, and people with neurodiverse backgrounds, the projects will provide scholarships and discounts, paid internships and placements, targeted outreach and mentoring programs, and flexible learning options.

This is the second round of the $70 Million AUD Cyber Security Skills Partnership Innovation Fund. After funding 8 successful grantees in round one, the programme’s guidelines were revised for round two to prioritise increasing the diversity of the cyber security workforce.

How CISOs will Respond in 2023

CISOs will focus inward. As IT spending slows down, CISOs are assessing their existing security programmes with a fine-toothed comb. This will lead them to concentrate their efforts in security hygiene and improving existing processes and controls, which will include process automation and more frequent security testing. Posture management initiatives will include discovering, analysing, and monitoring all IT assets. To consolidate security and IT operations is of high importance.

Investments will be more tactical than strategic. Long-term contracts are now a thing of the old; CISOs are postponing complex, resource-intensive projects. They’re breaking initiatives into digestible bites that feed only high-priority needs. Instead of zero trust plans, security and IT teams are focusing on access policies, application and data classification, network segmentation, and policy enforcement. While economic downturns usually lead to training budget cuts, the trend won’t be observed in 2023. To drive employee retention and improved productivity, CISOs plan to increase investments in staff training.

Services spending will dominate budgets. 45% of organisations say they have a problematic shortage of cyber security skills. They don’t have an adequately sized staff; they lack essential cyber security skills. Despite global layoffs, cyber security professionals will remain in high demand. CISOs have no choice but to augment internal staff and skills with service providers in areas like Identity as a Service, managed detection and response, and managed threat intelligence programmes.

Consolidation will give way to federation. Yes, organisations will continue to consolidate vendors and integrate technologies, but at a more gradual pace. Meanwhile, they’ll focus their efforts on individual security domains—cloud, email, endpoint, network, etc.

• Protect from Spear Phishing and CEO Fraud with GlobalSign’s AEG 7.6 and Ready S/MIME

  Spear phishing and CEO fraud are two of the most common types of phishing attack. They attempt to confuse employees by impersonating co-workers and C-level executives. Digitally signed emails counter this threat by clearly presenting the email sender's verified identity information. Recipients can be sure that the email came from a legitimate, verified source, and not a cyber attacker.

  GlobalSign’s Auto Enrollment Gateway (AEG) 7.6 breaks down the barrier that prevents many organisations from protecting against such dangerous cyber attacks. Fairly recently, this AEG 7.6 version introduced a new feature, Ready S/MIME™, taking the silent installation of Secure/Multipurpose Internet Mail Extensions certificates a step further by automatically configuring certificates in Outlook for Windows.

How CISOs Report Cyber Security Risks to Board

Presented to the board of directors, a CISO board report is a detailed summary of an organisation’s cyber security risks. This helps the board understand potential cyber threats so they can take a proactive approach to infosec for the company and its clients. 

A CISO board report helps to explain why investment in security is a vital component in an organisation’s success. It highlights the threats that matter most to the organisation. It contains a cyber security plan, a risk quantification with potential costs of security breaches, pertinent compliance and regulatory issues, and any necessary technologies or additional security hires.

In history, many breaches were due to three root causes: (1) failure to prioritise security; (2) failure to funnel resources towards security; and (3) failure to execute on security initiatives. The challenge was in getting senior management to understand how imperative it is to strategise and take action – and in engaging employees towards organisational change. There are ways for CISOs to get more cyber security buy-in, which involves cohesive storytelling, prioritising existential security threats, putting C.A.R.E. in leading, and connecting security plans to business objectives.

1. Shape a compelling narrative around cyber security.

   To set the vision, values, and agenda of cyber security, CISOs are well-advised to tell a powerful story to alleviate cyber security concerns and further the organisation's mission. It’s important to set the context right from the start. Lead the story with the risks, and the kind of attackers that might be motivated to harm your business. This is not to create fear, uncertainty, or doubt, but to offer a realistic view of the current threat landscape. It should also include the ways you're trying to slow attackers down, and how your systems neutralise them. If you do not have stories of how attackers have come after your organisation, you can borrow real stories from other organisations that are like yours.

   Lead the story with the kind of attackers and risks that might be motivated to harm your business. This is not to create fear, uncertainty, or doubt, but to offer a realistic view of the current threat landscape. It should also include the ways you're trying to slow attackers down, and how your systems neutralise them. If you do not have stories of how attackers have come after your organisation, you can borrow real stories from other organisations that are like yours.

   Make your narrative a lot less technical, else you will bore your board members. If you were able to stop or prevent the villains of your story from wreaking havoc through a new tool that your CEO had recently approved, then that makes him or her your hero. Basically, include the technology as a plot device, but make sure that it’s not the highlight.

2. Focus on existential security risks first.

   Organisations come with endless risks, and that’s why CISOs must focus on existential risks first, as these should never be allowed to materialise. For some businesses, intellectual property theft may be the most significant existential threat. If the villains you are up against can steal million-dollar blueprints, designs, or source codes that required years of R&D, your company proprietary products can be produced by them at a fraction of the cost.

   Similarly, online consumer services that rely on consumer information could lose credibility if data is stolen in bulk, therefore threatening the existence of an e-commerce site, for example.

3. C.A.R.E.: Are security controls Consistent, Adequate, Reasonable, and Effective?

   As your board members start to care more about cyber security (in part, due to regulatory fines increasing) it pays to understand how regulators think about cyber security. The acronym C.A.R.E. can be applied when putting yourself into an evaluator’s shoes. This is how they evaluate security controls and determine if your infosec programme will survive scrutiny. Check if your security controls are:

   • Consistent – marked by steady continuity or regularity?
   • Adequate – enough for a specific requirement or need?
   • Reasonable – not excessive, extreme, or underwhelming?
   • Effective – producing the intended (decided, decisive, or desired) effect?

4. Connect the dots between security initiatives and business outcomes.

   In your presentation, be sure to emphasise the link between your business strategy and the security programme. Results from a cyber security team are a lot more compelling when projects connect well to business goals that are focused on enabling or achieving.

   For example, instead of stating the goal as "achieve ISO accreditation," the goal is better stated as "solidify the credibility of the organisation in its focus markets by achieving multiple ISO accreditations.”