In this interview, Roger sheds light on the threats that are most complicated to detect, how small businesses can ensure optimal governance of their client data, and his cyber security predictions for the upcoming five years.
Roger Sels is the former VP of Cyber Solutions at BlackBerry. He is an accomplished CISO and CxO advisor with 20+ years of experience in developing and maturing new cyber capabilities. He has led large information and cyber security transformation programmes to manage business risks in Fortune-50 organizations.
In your experience, what are some of the most common oversights that IT leaders make when it comes to securing their data from cyber threats?
That’s an interesting question. For starters, I am not convinced IT leaders themselves are prone to the largest oversights. Security risks are not managed within a vacuum, solely under IT purview, but ideally managed together and on behalf of the business. Therefore, business and executive leadership, as well as the BoD, play a crucial role in adequately addressing these business risks.
Not involving the technology and security functions proactively and strategically, but reactively and tactically is a key oversight that leaves the teams always running a step behind. Those functions must articulate the risks in a business context, not in a technology context, to ensure proper buy-in of their mitigation. Addressing technical debt is often a large challenge.
What types of cyber threats are the most complicated to detect? Maybe you can give an example from real life?
Those that involve third parties, whether external vendors, suppliers, and partners that receive critical data or support critical business processes, as well as cloud-related risks (because of relatively poor integrations with regular detection and response processes and technology).
If the incident does not involve e.g., ransomware which is crippling operations and very obvious, but leaked data, it can be difficult to pinpoint the source of the leak – especially if data has been shared too liberally with ‘too many’ third parties.
How can small and medium-sized businesses implement technical infrastructure that will ensure optimal governance of their client data?
SMBs operate with entirely different challenges in terms of staffing: they have less budget and face stronger headwinds in attracting and retaining requisite talent. I am personally not of the opinion that for a ‘sufficiently small’ business overcoming these challenges without key outsourcing will be successful.
Often those businesses do not operate on a strict need-to-have and need-to-know basis, i.e., too many staff will have access to data, unnecessarily. They may also have too many staff who have high privileges (local admin on their endpoints).
Getting in place technology to manage the privileges and access to data as well as prevention of data leakage could be a key priority (depending on the maturity of the rest of the business as well as vertical operating and potential regulatory requirements).
What trends do you foresee happening in the cyber security landscape over the upcoming 5 years?
The cyber security landscape is very fragmented. We will see the continued rise of ‘super vendors’ that offer platforms to address a number of key risks, with an ecosystem of services around it, so cyber can be more of a turnkey solution to be consumed as opposed to a solution each organization has to serially implement. There is currently too much ‘reinventing the wheel’.
