Public and private collaboration

Cyberspace security challenges in the US are well documented for the private and public sectors. These concerns have the attention of many federal agencies and entities. The work of the U.S. Cyberspace Solarium Commission, for example, concluded that coordinated action plans are needed across many fronts. Established through federal legislation in 2018, the Cyberspace Solarium Commission issues annual updates with the most recent being the 2021 Annual Report on Implementation.^[1] It doesn’t sugarcoat the viewpoint that it is time for leaders in business to step up and accept responsibility: Proactive protection measures are overdue for critical infrastructure and information. Government must also do the same to address its own impediments, where “issues of jurisdiction, bureaucracy, and underinvestment hamper efforts to combat cyber threats, build effective public-private collaboration, and promote responsible behavior in cyberspace.” To accomplish this, the commission formulated 82 initial recommendations, supplemented by white papers. While many recommendations require legislative or executive action, the commission highlights those that have already been successfully implemented. As recommended, the new position of national cyber director was created; it has been filled by Chris Inglis.

Director Inglis is a well-publicized proponent for collaboration between government and industry, who categorizes it as a vital partnership and key to data privacy. This collaboration is viewed as movement in the right direction to prevent cyberattacks in the first place, and to assist with countering and recovering from them. The level of risk involved is viewed as a burden to be shared and addressed through public–private collaboration.^[2] Also, to foster these public–private sector relationships to manage and drive down risks prior to incidents, the Cybersecurity & Infrastructure Security Agency established the Joint Cyber Defense Collaborative in August 2021.^[3] More and more government resources are becoming available for collaborative efforts with the private sector.

Managing risk

Many business leaders charged with setting the tone at the top rank cyberthreats as one of their primary concerns. Making informed decisions on cyber risk is an agenda item for decision-makers. Informed decisions are often based on qualitative or quantitative data. What is available for managing cybersecurity risks? The National Institute of Standards and Technology (NIST) summarizes this as “an under-developed topic” that lacks even standardized terms.^[4] NIST plans to create an organized repository to address cybersecurity measurements, including tools, research, standards, and guidelines. Through this undertaking, NIST’s measurement program for cybersecurity is expected to help with risk management in this area.

Complexity in the cyber arena does not help to manage these risks. In its C-suite guide 2022 Global Digital Trust Insights, PwC notes that sound practices and controls can prevent many breaches.^[5] This survey uncovered that executing certain advanced practices greatly assists with achieving cyber goals: “instilling a culture of cybersecurity, managing cyber risk, enhancing communication between boards and management, and coordinating cyber strategy with business strategy.” Cybersecurity and data privacy are everyone’s responsibility, not just the CEO or IT department. Data breaches can quickly lead to customer care challenges. This survey highlights the opportunity to get it right and reap those customer trust benefits. Building and maintaining a reputational advantage in this area could have positive bottom-line impact as well.

Another recent survey from the United Kingdom includes additional information for review and consideration. The Cyber Security Breaches Survey 2022, published by the UK Department for Digital, Culture, Media & Sport, explores institutional approaches to cybersecurity.^[6] Specifically, it considers the types of cyberattacks encountered, their impact, and responses. The most common threats include phishing, service denials, malware, and ransomware. Given the complexity of concerns, the survey noted that the lack of board understanding equated to the risk baton being passed on to third-party providers, insurance companies, or internal employees.

Among many other important findings in this survey, cybersecurity may have been a factor at the beginning of selection for services like email providers or data storage, but pricing may rank higher during actual procurement. Interestingly, assumptions were made that outsourcing to technology companies automatically brings cybersecurity along with products or services. Further, the use of personal devices for official work purposes was reported as 45% of businesses and 64% of charities. With the work-from-home shift, this growing area of cyber risk needs to be noted for both public and private sectors. And whether it is older software on work devices or older personal devices used for work purposes, outdated software can also pose risk.

Conclusion

Through continued and more extensive collaboration of public and private sectors, the goal is the prevention of cyber threats and attacks. Sound practices and controls can immediately help mitigate some cyber risks now. A careful review of policy choices for governance in this area is important. Information gathering on current attacks is necessary. How many phishing attempts has your organization encountered this week? How long did it take to discover them? Or to fix a problem because of them? What do you really know about how cybersecurity is addressed by your third-party vendors? Are policies for use of personal devices really monitored and audited? While some external disruptions may be unforeseen, others are expected and should be managed accordingly.

Takeaways

• Enact and maintain effective policies for employee use of personal devices, whether used at work or for work.

• Inventory all systems used and assess compatibility for cybersecurity purposes.

• Review third-party vendors by requesting cybersecurity verification at the beginning of, as well as throughout, the business relationship.

• Make cybersecurity an operational goal, tie it to business strategy, and encourage use of cross-functional teams.

• Invest in and update infrastructure to proactively protect it and safeguard information within it—for both private and public sectors.