Steve Brown serves as Mastercard’s Vice President of Cyber Security & Resilience for Europe. In his role, he is at the forefront of implementing and integrating Mastercard’s Cyber Security Framework, which encompasses data breach detection, cyber risk, and resilience technologies. Steve’s expertise extends across various stakeholders, including issuers, acquirers, merchants, and governments, ensuring robust cyber defenses and operational resilience.
In this insightful interview, Steve emphasizes the increasing priority of cybersecurity in business continuity and its impact on the bottom line. He highlights how cybersecurity has evolved into a top C-Suite concern, driving operational strategies and corporate trust. Steve also discusses the complexities of third-party and supply chain risks, advocating for greater automation and proactive risk management. By leveraging innovative cyber defenses, businesses can not only protect their operations but also gain a competitive edge in today’s digital landscape. We hope you enjoy what he has to say.
How does cybersecurity impact business continuity and the bottom line in today’s digital landscape?
In an increasingly digital world, cybersecurity is climbing the priority list for business leaders. While the excitement around evolving technologies is palpable, the boardroom is becoming increasingly aware of the risks that come with it. The impact of a cybercrime can be debilitating. Globally, the average data breach cost $4.45 million in 2023. This cannot be left to chance. In response, cybersecurity has quickly progressed from an IT challenge to a C-Suite priority; it’s now the top digital risk businesses face today. The best way to fight cybercrime is to understand the risk. What does it look like? Why does it happen? How can it be stopped? Both cyber leaders and their vendors must possess this intelligence before they deploy their defenses.
What role do cybersecurity strategies play in shaping corporate reputation and trust?
Cyber security and operational resilience are now an integral part of any organisational strategy. The ability to identify vulnerabilities, detect threats and mitigate risks can be the difference between success and failure.
While enhancing consumer convenience, the increased reliance on third-parties has also led to greater complexity in payments acceptance and processing. An explosion of digital players, applications and devices is continually infused into the payments ecosystem, creating infinitely more undefined, and often inadequately protected, connections to other stakeholders. The ecosystem is under perpetual threat of widespread attack as a lack of proper third-party / supply chain risk management continues to create infinite points of vulnerability. Cyber criminal groups, indeed Nation States are exploiting the weak links in that supply chain, targeting applications and providers that neglect to utilize stringent network, regulatory and security standards and protocols. Over the last couple of years alone, attacks such as SolarWinds Orion, Apache Log4J and MoveIT have all highlighted the propensity of those within the supply chain to be victim to cyber attacks. As a result, all stakeholders are at risk of attack—even those with strong individual cyber and fraud protections in place.
What are the key components of a resilient enterprise cybersecurity strategy in the face of evolving threats?
To be resilient, it is imperative to recognize the gaps that exist within an organization or indeed, the wider ecosystem. Until now, the industry has lacked understanding about how these disruptions are impacting organizations…and in turn, difficulty in mitigating these risks as they are presented.
Organizations are unable to look across third-party business relationships because of the lack of systems and processes available. Of course, who you’re doing direct business with is important – but what about who your partners are doing business with? For example, if a business that you’re heavily reliant on is working with a sanctioned entity or suffers a major cyber breach due to one of their own suppliers – that’s a risk that you might not have visibility into.
In addition, most current risk monitoring practices are outdated – they involve teams of people, antiquated manual surveys and a large dependency on other organizations’ inputs/disclosures.
In short, it requires extensive resources and is labor intensive – yet yields inconsistent results. It requires automation.
There’s also the consistent monitoring required to be best equipped to mitigate risk. It’s imperative to proactively identify risk before disruption can occur, however, often continuous and proactive has previously been unavailable to organizations.
Lastly, there are fragmented risk monitoring systems – meaning that different systems/teams/processes monitor different types of risk and lack a comprehensive view.
What are the most effective ways to communicate the value of cybersecurity investments to stakeholders?
At Mastercard, we continually invest in cyber security and network protection to address evolving widespread threats to the ecosystem. Our acquisitions (and development) of capabilities such as RiskRecon & Baffin Bay, demonstrate Mastercard’s commitment to invest and provide much needed capabilities to our Customers and Partners to drive operational resilience.
Mastercard hold a unique position to be able to gather and analyse intelligence that is then used to inform risk assessments against transactions, connections to third-parties, 4th parties and beyond. Risk assessments exist to compel a form of action and Mastercard provides and advises on mitigative capabilities that drive operational resilience throughout, and help build and maintain trust across all points of the ecosystem. Trust must be given and received from both sides and new regulations such as DORA and NIS2 should be seen as an enabler to this.
All risk areas are intertwined – meaning the security and trust within one is now dependent on another. As an example, we must ensure the validity of a website within the cyber realm so that a payment in the digital payments space can go through decisioning within the connected intelligence process.
As the world changes, so Mastercard is addressing a wider range of risk domains that not only protect every transaction but the larger ecosystem of interactions beyond those transactions.
How can businesses leverage cybersecurity as a competitive advantage?
In a world seemingly besieged with crisis, there often lies opportunity. Cybersecurity is no exception. It’s widely known that businesses suffer a wide range of cyber issues, ranging from malware and phishing attacks to employee knowledge gaps and third-party vulnerabilities. What is lesser known is the technology that can power effective cyber defenses in 2024. There are many aspects to cyber security measures and when deployed in unison, cyber leaders can defend their organizations in the same way that we might defend our homes. They ensure all doors and windows are secure to prevent unauthorized entry, similar to API security; they provide authorized visitors – colleagues – with the right key to enter, the same as identity; and they receive real-time weather intelligence to see if a threats coming and whether more action is needed. This is the future of cybersecurity. The innovation taking place today will empower tomorrow’s cyber leaders to tackle their greatest fears – providing they’re granted the resources to do so. And there can be no better way of securing a competitive advantage than by demonstrating to customers, shareholders, Board members and Investors that a company truly values the confidentiality, integrity and security of their data.
What is the current state of public-private collaboration in cybersecurity, and are we making progress?
Progress is bring made but there is always room for improvement. Cyber criminals, organised crime groups and Nation States are continuing to work together, to invest and invent new ways and services designed to infiltrate and exploit. Public-private sector collaboration is therefore critical in identifying and mitigating the risk of cyber crime. In May, Mastercard announced the opening of its European Cyber Resilience Centre (ECRC) at our European Headquarters reaffirming our commitment to combatting cyber threats and enhancing resilience in the region. The new state-of-the-art centre will sharpen defenses against cyber threats, speed up response times and serve as a hub for thought leadership in cybersecurity, fostering collaboration between the public and private sectors.
With continuous digitization and unprecedented levels of connectivity, cybercrime presents a shared challenge across all organizations. Fraudsters are using technology in more innovative and sophisticated ways to try and harm consumers and businesses. – this problem is only growing. Cybercrime has turned into a global economy now estimated to be worth trillions of euros. To address this ever-evolving threat landscape, Mastercard’s ECRC brings together partners from across the public and private sectors. By leveraging its facilities and diverse talent pool, it facilitates collaboration with national cyber intelligence centres, law enforcement agencies, and industry bodies across Europe.
What are the best strategies for understanding and mitigating risks in supply chain cybersecurity?
Greater automation lies at the heart of more operationally mature third-party risk solutions. The top pain points we see are the practical problems risk leaders want solved, and both are aspects of improved operational maturity. Risk teams are significantly challenged by a heavy resource burden for the tools and process and accuracy/quality challenges for risk assessment. Fewer TPRM programs are giving the green light to vendors without some level of remediation, which suggests they’ve gained more authority to act. That’s a positive development for managing third‑party risk. But we also see some signs pointing to limitations in that authority. Just over 3 in 10 organizations make a habit of reducing the scope of TPRM assessments for vendors with a strong security track record. This seems like a missed opportunity to adopt a risk‑based approach that could create efficiencies by diverting focus to poor performers. Almost half of TPRM programs claim to have the authority to block the onboarding of new vendors based on security concerns revealed during assessments. But a much lower proportion (28%) say they’re able to terminate existing vendors over security concerns. Ideally, those should be in better alignment, since they’re two sides of the same TPRM coin. And finally, nearly 60% of programs report having the authority to require vendors to implement additional security controls. While that represents the majority, it leaves 40% of teams without the ability to use a tool that would seem fundamental to managing risk. One can’t help but wonder if such limitations contribute to the rising frequency of third‑party incidents documented earlier in this report. Time will tell.
Organizations place greater strategic priority on TPRM to contribute to a widening scope of enterprise risk that extends beyond cybersecurity. It’s also clear from these results that supply chains are expanding as is the need to efficiently assess risk across those business relationships. Respondents tell us they’re increasingly relying on automated assessments and risk ratings to meet that demand. The big question is whether cybersecurity risk ratings solutions have risen to the occasion. Mastercard are biased on this matter, of course, but can say with all sincerity that our own approach to the shortcomings identified above has matured substantially in the intervening years. It’s had to; customers won’t tolerate stagnation when their reputations are on the line. Their requirements are our roadmap, and further just cause for our continued investment and development of cyber security and resilience capabilities.
