Cyber Security Optimisation In Organisations - Pwc

December 2020Cyber in PerspectiveSecuring thefuture of businessCyber security optimisation in organisations

IntroductionBusinesses today are transforming their ways ofworking and redefining the future of their operations.They are migrating towards a ‘work from anywhereand anytime’ model of operation, with an increasingfocus on utilising low-touch business solutions.There is also increased focus on business resiliencein order to strengthen systems and processes sothat they operate seamlessly during a crisis.Rapid diglitalisation across organisations hadalready made them prone to cyberattacks. TheCOVID-19 crisis has resulted in an increase in thenumber of cyberattacks on organisations. Alongwith a surge in cyberattacks, there has also been ashift towards more sophisticated attacks that seekto exploit the chinks in the armour exposed by thetransformation process that is under way. Such ascenario requires organisations to enhance theircapabilities in order to successfully navigate theincreased threat surface, ensure protection of theirdata and smoothly continue business operations.The COVID-19 crisis has impacted a number oforganisations and increased cost pressures. Thecrisis has also made it imperative for organisationsto enhance their cyber security capabilities on theone hand and optimise cyber security resources onthe other.2 PwC Securing the future of business

Organisations are focusing on how to deal withthe dichotomy between cost reduction andcyber security optimisationFactors behind cyber recalibrationBusiness objectivesTransformation to adapt to thefuture of businessIncreased cost pressureEnhancing cybersecurity capabilitiesEver-increasing cyber threatlandscapeIncreased COVID-19 themedattacksOptimising cybersecurity resourcesShift in cyber security prioritiesSecurity optimisation across areas will help businesses achieve their objectives.Securitytechnology3 PwC Securing the future of rityprocesses

Security optimisation is the key to secure thefuture of businessSecuring the futureof businessAutomation ofsecurity processesAgile securityorganisation4 PwC Securing the future of businessSecurity technologyoptimisationOptimised securityoperations

Security technologyOrganisations are struggling to optimally utilise their implemented security technologies. Often, there are overlaps insecurity technologies as well as underutilisation of tools and technologies.Organisations need to focus on understanding their security technology landscape and identify areas wheresecurity technologies can be optimised either through consolidation and enhancement, or by leveraging opensource and light-weight start-up solutions.Optimised security operationsAt an overall organisational level, the costs of security operations and management are increasing due to the widerthreat landscape. Traditionally, organisations build all of their operational services in-house on a fixed-cost model.However, this approach has led to increased costs, administrative burden and the additional hassle of managing alarge set of internal tools, technologies and in-house resources.There is scope for improvement in the way organisations handle security operations and associated costs. Theycan explore other avenues such as managed security services, cloud-based service delivery and transaction-basedpricing models.Agile security organisationDue to the cyclic nature of most businesses, it has been observed that required skills are dynamic and change withtime. Skills related to cloud technologies, orchestrated response and emerging technologies are becoming moreimportant. While organisations may hire people skilled in operating new technologies, upskilling and cross-skillingexisting resources are more efficient, considering evolving requirements.Organisations may consider engaging external experts as chief information security officers (CISOs) in othersecurity roles to optimise the costs of hiring and training. Additionally, there is scope to leverage existing resourcesin cross-functional teams to build extended teams and support security requirements during critical situations.Automation of security processesSecurity teams in organisations spend a lot of time performing low-intelligence routine tasks. Also, mostorganisations do not have centralised security teams, leading to a disintegrated view of the organisational securitylandscape. Organisations need to move away from such siloed processes for security management and graduallyshift towards a more cohesive approach, with automation as the basis of security processes and operationsmanagement.Automation technologies help in decreasing the administrative burden related to manual handling of certain aspectsof security processes. Leveraging these technologies as the foundation for managing security processes will notonly optimise the effort and resources required for maintaining cyber security across organisations, but also help inreducing the overall error rates and associated security risks.5 PwC Securing the future of business

Security technologyoptimisationSecurity technologies have continuallyevolved to meet the growing demandsof an increasingly changing threatlandscape.While it is necessary to implementsecurity technologies across anorganisation to protect it against theevolving cyberthreat landscape, it isalso important to understand the overallsecurity posture of an organisation andoptimally deploy security technology.Security technology optimisation is the quickestmethod to optimise cyber security for an organisation.Typically, organisations have focused on creatingmultiple layers of security and using a combination ofsecurity products, design principles, manual controlsand routine checks to manage their overall securityposture.Organisations that have been on the cyber securityjourney for a significant period of time will understandthe need to regularly take stock of their security stack.Security tools and solutions have a tendency to overlapor remain underutilised if left unchecked.Additionally, organisations have approached cybersecurity in a piecemeal fashion by adding technologiesto their set-up whenever they felt it was necessary tofill certain point-in-time security gaps, overlooking theoverall security posture.Further, organisations consider established commercialoff-the-shelf (COTS) products for their securityrequirements and do not generally consider otheroptions, including open source/domestically producedsecurity tools, that may provide the desired level ofsecurity contextualised to the threat landscape.6 PwC Securing the future of businessToday, it is imperative for organisations to look attheir security technology stack holistically to enhancesecurity and optimise resources.Many organisations have invested in multiple securitytechnologies, some of which have overlapping features.This happens as some new-generation technologiescombine the multiple features provided bytraditional technologies. For example, next-generationfirewalls have capabilities such as intrusion prevention,URL filtering and application control, along with featuresprovided by traditional firewalls.Organisations can enable additional features andfunctionalities in their existing security set-up toprovide additional security coverage. For example,threat intelligence feeds can be enabled in nextgeneration firewalls, security incident and eventmanagement (SIEM) tools and anti-advanced persistentthreat (APT) systems to provide contextual informationon security events.Organisations can also look at implementing opensource security solutions as well as light-weightstart-up security solutions and services that providethe desired level of security at optimised costs.Given the aforementioned considerations, there isa huge opportunity for organisations to optimallyleverage security technologies.

Optimised securityoperationsManaging the overall security operationsof an organisation involves striking a finebalance between handling operationalrequirements and using resourcesoptimally.It is imperative for organisations to evolvefrom traditional security operationalmethods and costs to flexible securityoperations with a managed securityservices model.Cyber security services have traditionally been builton-premise and their service provisioning operateson a fixed-cost model. However, this can lead tounnecessary cost overruns.Pay for what you needFixed costs are easier to budget for since they remainconstant during a year. However, with evolving businesslandscapes and shifting operational priorities, securityorganisations should strive to identify linkages betweenbusiness functions and related security services. Thiswill enable them to move to a variable cost model andsuccessfully mitigate increasing budgetary constraints.Cyber security activities such as monitoring a 24x7security operations centre are already being outsourcedto enable variable cost models that help organisationsmoderate their security spending. The current crisishas also triggered a need to relook at how day-to-daysecurity operations, administration and managementactivities can be carried out by leveraging third-partymanaged security service providers.7 PwC Securing the future of businessOrganisations can leverage third-party securityservices across multiple areas, including governance,implementation, operations and compliance, toimplement the security as a service (SaaS) model.Organisations may also consider implementinginnovative cost-optimisation models that allow them topay on the basis of the number of security componentshandled/assessments done/incidents resolved.Similarly, organisations can leverage cloud-basedsecurity solutions that enable security teams to deploya cloud layer over the existing IT landscape, allowingservices, including user identity management, securitymonitoring and incident management, to be centrallydelivered. The service requirements can be increased ordecreased, allowing for subsequent cost optimisation.Organisations can also look at outsourcing oroffshoring security operations to low-cost locationsto optimise associated costs.Given the above background, organisations shouldrethink their expenditure on cyber security operationsand move towards a managed services model for notonly security monitoring, but also day-to-day securityadministration and operational activities.