Magazine menu Close Magazine menu

Author

Susi O'Neill

Susi O’Neill is the Editor-in-Chief of Secure Futures. She’s a seasoned creative who’s led business content programs for brands including EY, GSK and Unilever. Off the clock, she’s a musician and performer who gives international performances playing theremin, the world’s first electronic instrument from 1920s Russia.

Latest stories by Susi

enterprise cyberthreats 2022

Five indispensable cyberthreat insights for enterprises

  • Enterprise cybersecurity
  • min read
    • Cyberthreats and cybercriminals' methods change all the time. Each year, we see things we've never seen before. Understanding what cyber researchers are finding can help your enterprise stay ahead of evolving cyberthreats, preventing costly data breaches and malicious damage. Kaspersky has the biggest global network of cybersecurity research and analyst teams, collaborating closely with product research and development. With expert researchers distributed across the globe, we see can escalate and respond to local situations fast. Here, we share some of our recent observations your business can act on today. 1. Ransomware is stepping it up a notch Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team (GReAT,) Latin America, says: "This year, ransomware is no less active. Cybercriminals keep threatening retailers and enterprises worldwide. Watching these tendencies gives us threat intelligence to fight cybercrime today and helps us prepare for what we may see in the months to come. "Our research groups ransomware into three big trends: Ransomware that adapts to be able to infect different platforms, ransomware becoming more "industrialized" and cybercriminals taking sides in geopolitical conflicts. But despite its ever-increasing sophistication and targeting, there's still much enterprises can do to stay safe." What to do: Find out about the five best steps your business can take to fight ransomware – from keeping software up to date, to ensuring your Security Operations team has access to the latest threat intelligence. 2. Advanced Persistent Threats are coming out of the woodwork An Advanced Persistent Threat (APT) involves sneaky, sophisticated hacking techniques. It may hide malicious software in your system for a long time, stealing information or waiting for the moment to cause maximum damage. Kaspersky tracks more than 900 groups of APTs. David Emm, Principal Security Researcher, GReAT Global, says: "We became aware of a firmware-level APT compromise through our firmware scanner logs. The attackers had modified a single component to intercept the machine's boot sequence and introduce a sophisticated infection chain. The chain leaves no traces on the hard drive, as its components operate in memory only – a fileless attack with a small footprint." The researchers named the new ATP MoonBounce and have linked it to a known threat actor. What to do: Arm employees with the knowledge they need to protect your organization. Get APT threat reports on SecureList. 3. Apps can make Internet of Things devices even more vulnerable The Internet of Things (IoT) is a fast-growing ecosystem – forecasts predict we'll use more than 75 billion IoT devices by 2025. Among these, companion apps for internet-connected cars have attracted special attention. In early 2022, a 19-year-old hacker shared how he had accessed and controlled more than a dozen Tesla cars through their apps. The vulnerability of IoT devices, increasingly part of manufacturing and industry processes, has long been known. Our interest in transparency recently spurred Kaspersky analysts to look at car-controlling apps, finding their security and openness often lacking. What to do: Dan Demeter, Senior Security Researcher, GReAT Europe, Middle East and Africa says: "For an ongoing well-established security perimeter, we recommend periodic checks and updates for all applications used withing the perimeter, whether it's a consumer or a business environment. Remove any obsolete or not used apps from these environments as soon as possible." Demeter also highlights better practice among some vehicle companion apps. "Some use specially designed solutions from automakers, which, for example, make it impossible to unlock the doors remotely. With access to the vehicle's data through the manufacturer's website, there's no need to give credentials to an app, and users can revoke access any time." 4. Geopolitical tensions are raising denial-of-service risk Distributed Denial of Service (DDoS) attacks are cybercriminals' go-to targeted attack. They overwhelm a server, service or network with a flood of traffic, so you can't give your customers reliable online service. The Russia-Ukraine conflict has triggered a spate of DDoS attacks in both countries, targeting critical infrastructure, media and state-run services. Hacktivist groups have instigated some of these attacks, distributing apps, software and even games which can teach cybercrime skills to those with other aims, like extortion. Kaspersky researchers have noted a sharp rise in DDoS attacks across the board. What to do: Researchers advise businesses and nation states to prepare for DDoS attacks before they happen, through investing in suitable security controls and preparing defensive strategies with national internet service providers (ISPs.) Maher Yamout, Senior Security Researcher, GReAT Middle East, Turkey and Africa, says: "Deploy cyber defenses in advance. When an attack comes, it's too late. You never know when an emergency will happen, so today's the day to take care of your anti-DDoS protection." Threat intelligence also plays an important role in preventing DDoS attacks. Kaspersky is the only global threat intelligence provider with a major presence and expertise in Russia, where most advanced persistent threats and attacks originate. Security teams should subscribe to Kaspersky SecureList to stay up-to-date. 5. Malware keeps upping the ante Malware is common and costly. Over the past year, Kaspersky software prevented at least one malware attack on 20 percent of our users. Recently we've seen plenty of new and rehashed techniques aimed at disguising malware or letting it do more damage. Dr Amin Hasbini, Unit Head of GReAT Middle East, Turkey and Africa, says: "Since its discovery in 2014, we've seen the malware Emotet – originally designed to steal banking credentials – in many other forms, like as a delivery system for other malware and and botnet executable, using small employee mistakes to create big incidents. It mostly spreads nowadays through malicious email spam." What to do: Malware attacks often start with an employee making a small error of judgment, like clicking a link in a dodgy email, so one of the best ways to stay safe is to thoroughly educate all your staff in cybersecurity. Kaspersky research in partnership with Longitude, a Financial Times company, found leaders whose cybersecurity training programs can keep pace with the threat landscape say their companies are better prepared for a cyberattack. Immersive cybersecurity training is a powerful way to engage your workforce with learning in an age when there is much competition for their attention. Advanced cyberthreats are common. They have a big impact on business reputation and bottom line. When business leaders take cybersecurity action, they avoid spending more time later mopping up a cyberattack's damage. When choosing your cybersecurity vendor, look for those that participate in third-party tests and reviews, win awards and achieve top scores in independent tests. What's clear is that advanced threats are ever-changing, so having the most up-to-date threat intelligence will always be crucial for your business.  
trust global business

New research on how to build trusted business relationships worldwide

  • Leadership
  • min read
    • Trust is the building block of all relationships, but the way we build trust in business isn't the same the world over. Tyree Mitchell is assistant professor at Louisiana State University School of Leadership and Human Resource Development. His latest book with Jeanne Brett, Searching for Trust in the Global Economy, shares findings from studying managers in 33 countries, revealing differences in how they nurture trust relationships. It also asks if the pandemic has changed how we make decisions about trust. I spoke with Tyree about his research and ideas to improve relationships in virtual and global tech teams. Susi O'Neill: Why did you focus on international differences in trust for your research? Tyree Mitchell: Global economic development needs new business relationships. Negotiating them is tricky – there's much uncertainty, vulnerability and unmet expectations. Trust is critical. When negotiators trust each other, businesses use fewer resources to prevent exploitation and have better economic outcomes. Most research and theories on trust are from a Western perspective. Data from the World Values Survey shows different responses. For example, the US is higher on trust than Brazil. To build relationships, you must understand how trust varies between cultures. We wanted to explore what that means when negotiating business relationships and understand from managers and executives how trust happens. How do we decide if we'll trust a business partner? We learned from the 82 managers we interviewed four key actions they use to make trust decisions. First, due diligence – searching for information about the new partner, including financial status, ratings and reviews and data gathering on social platforms like LinkedIn. Second, brokering – a special introduction where a third party puts their reputation on the line. We particularly see this in East Asia. Third, goodwill building – interacting socially to get to know the partner, like grabbing a coffee or going to a sports event together. Finally, testing – getting the partner to act or react, like asking a question when you already know the answer. We want to know if they will be upfront about company difficulties or cover up problems. In the West, we use testing to check if you're forthcoming and honest, as the assumption is you can be trusted. In East Asia, testing is about checking competency, as people tend to embellish things, so partners want to know if you can deliver what you promise. From these actions, we found four standards for determining if someone is trustworthy -- competence, openness, respect and rapport (CORR.) Competence means, are they capable with the knowledge and skills to deliver on their promise? Openness means are you honest and forthcoming? Respect means showing regard for one another, even if you don't have shared values. Rapport refers to building affinity around shared values. What were the main differences you saw between research participants? We analyzed the 82 manager interviews using a framework based on regional differences in trust and the tightness of social norms. There is a cultural difference in how people answer the question, can most people be trusted? For example, in India, the answer is more often 'no' and in Sweden, more often 'yes,' so we call India' low-trust' and Sweden' high-trust.' There are also differences in tightness and looseness of social norms and consequences for deviating. For example, China is high-trust and tight, the US is high-trust and loose, India is low-trust and tight, and Mexico is low-trust and loose. To understand cultural differences in trust decisions, you must understand these differences. There are also differences in how different cultures decide to trust. East Asians emphasize testing more than Middle Easterners or Latin Americans. Latin Americans and Middle Easterners emphasize goodwill building more than East Asians. Latin America, the Middle East and South Asia are lower trust. But in Latin America, rapport and establishing shared values are more important. Respect for cultural differences is vital in the Middle East and South Asia. This may be because the institutions that monitor and sanction deviance from norms in 'tight,' but more diverse cultures don't cross ethnic boundaries. What were the most surprising research findings? East Asia and the West focus primarily on the business relationship. If there's a business relationship, the personal connection follows. China and UK's behavior was similar, but social norms are different. On brokering a relationship through a third party, one US manager asked, "What's in it for the person making the introduction?" That's not considered in the 'tight' East Asian culture – if the third party puts their reputation on the line, they're good to deal with. In this culture, someone can be outcast if they bring embarrassment on themselves or their family – the stakes are higher. How can transparency be improved between partners? Share information openly and honestly. Anticipate being asked questions about past performance and how you see the future relationship. Your potential partner may interpret reluctance to share as hiding, so when you can't share information, explain why. Signal you're engaged and want to learn more by asking questions. Trust is a two-way street. Are there differences in how people build rapport and trust in person versus online? During the pandemic (in the fall of 2020), we went back to the same managers we spoke to before to ask how they developed new relationships and made trust decisions virtually. A manager from Brazil said they found ways of keeping the spirit of face-to-face using technology, as talking to someone online is the same way to make a connection. Could virtual reality (VR) and the virtual office help bridge the geographic divide? Engineers and scientists I've interviewed for other research reacted negatively to the idea that VR could replace or substitute for face time. Personally, I'm comfortable using video conferencing, but I've found using a video game character awkward. I like the possibilities, but our ability as humans to get up to speed and be open to it can be a challenge. The reluctance to use virtual technology could be partly generational. When we re-interviewed managers during the pandemic, one manager from Palestine mentioned that his father initially felt the business could survive without using technology. However, when it was time to make a serious business decision, his father would ask: "Can you send an email or do something?" What advice can you share for managers of international tech teams? Other research shows challenges in inter-cultural teams include violations of respect or hierarchy, prejudice and lack of common ground. Communication styles vary – in East Asia, it's more indirect, but in Latin America and the Middle East, it's more direct. Don't leave anything to chance. While putting together this charter, your conversations will help define how you'll deliver. If someone doesn't show up to a meeting, what happens next? A shared team mental model about what to expect reduces uncertainty. Nothing is perfect, but the charter negates some pitfalls by getting collective agreement.
data transparency center

How transparency centers and open data processing practices help your business

  • Data and privacy
  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.
Team Brit disability racing

Top gear: This winning team’s tech makes racing accessible

  • Tech for good
  • min read
    • Motor racing is demanding and competitive. But what if you had to drive without your feet or with one hand? Team BRIT is smashing perceptions of what a disabled racing team can achieve. I met team Principle Dave Player and driver Chris Overend to learn more about Team BRIT and find out what business can learn from their methods, attitude and success. What's the story behind Team BRIT? Dave: I'm former army – I spent five years in the Royal Engineers. I've been involved in disability sports for 25 years. I use a wheelchair now. I wanted to do something for injured soldiers coming back from Afghanistan. In 2010 we launched our charity Kartforce. I wanted to design a simple solution with rented cars that was quick and easy to install and remove, low cost and reliable for the rough and tumble of racing. The result was a simple set of hand controls easily fitted into karts to offer rehabilitation and recovery sessions for injured troops. In 2015 the racers wanted to set up a car team. But we had the same challenge with hand controls. Disabled drivers have push-pull hand controls bolted to the steering column. One hand pushes the brake and pulls for throttle, the other hand steers. For racing, you'd need a third hand to change gear. I gave the challenge to our engineering director Al Locke: We needed to go through a chicane (serpentine curve in a road) at the same speed as a non-disabled driver. We achieved that, and kept evolving. Chris: We race against non-disabled drivers in endurance racing championships. We're every bit as fast and competitive. Endurance racing is arduous, but you don't develop as much body heat when not using your legs, which could be an advantage. What are the cars like to drive? Chris: I drive an adapted BMW M240i. In the boot there's a heavy duty case, hydraulic cylinder and compressor that runs the throttle and brake pneumatics. I use my thumbs to control a rocker-switch. We have a huge range of disabilities in Team BRIT. We can change the distance to the steering wheel as we have different size hands, but everything else about the car is the same. I shift gears with my thumbs: Left thumb up, right thumb down. It's opposite to the usual race car but helps avoid overloading your brain. I practice with simulation to learn to drive subconsciously. Dave: We needed to find reliable and robust existing technology. We tried experimental throttles that would overheat. Military tech can take more abuse than road cars, so we developed a hand control system now recognized as best in the world. How are you developing the tech? Dave: We're constantly improving the tech. We're working on a project for a quadruple amputee with knee and elbow amputations. We test scenarios by setting up a simulator to see how it works for her. Instead of the paddle on the steering wheel, controls could be on the race seat, so she'd squeeze her right leg for throttle and left leg to brake. Our hand controls also help disabled people to get into simulated motorsport, or iRacing. eTeam BRIT competes in online racing competitions. We provide opportunities for drivers worldwide to race competitively from their homes. What achievements are you most proud of? Chris: My greatest moment was the last race at Silverstone. We finished first in class. It was the first time we got on the podium. Dave: Our growth. We're achieving beyond what we thought possible. We're smashing perceptions. What's next for Team BRIT? Dave: We want to show there's no limit, as long as drivers have the skills. We want to be the first all-disabled team to compete in the 24-hour endurance race Le Mans 2024. We could use a non-competitive wildcard entry to showcase new technology, but we want to earn our place on the grid to compete. Chris: In sprint racing, you dive for each corner, but endurance racing is all about consistency, positions and discipline. You must manage your fuel and resources to get the car to the end. It's a psychological and physical workout. I want to win the championship this year, then move up a category to British Endurance Championship or British Grand Prix. How can motorsport become more inclusive? Dave: The motorsport community has been supportive. Other drivers say seeing disabled drivers winning is inspiring. There are many disabled racing drivers in the UK, but government bodies are behind the times. Motorsport UK should be leading the way, but they aren't. What advice can you give someone who wants to get into racing? Dave: Start with the driver. Motorsport isn't suitable for all disabilities. To get a race license, you must be able to escape from a car in 10 seconds. You need to be mobile and have strength and agility. Ninety percent of the work is off track. For a disabled driver, there are no shortcuts or grants. You must find sponsors, like every other driver. You need to invest time in the business and raise your profile. Use social media to elevate yourself. Chris: There are great opportunities for disabled sportspeople today. Team BRIT is a dream come true. Dave: Team BRIT is here to help. We haven't patented our hand controls and share what we've learned with similar organizations overseas. We can help with information on getting a license or medical certificate, and ways to race. You can start affordably by paying a team to rent a car and there are low-budget cars. You could find a group of like-minded rookies and do team racing together each year. We want everyone to enjoy racing.
deepwell gaming therapy

Are games the future of mental health treatment?

  • Start-ups
  • min read
    • In Kaspersky's Bring on the Future series, we meet people and businesses worldwide who are changing things for the better. One of the biggest challenges for mental health treatment is reaching more people who need it. Some don't realize they're mentally unwell. Others can't access therapy because of costs or waiting lists. Many don't like the idea of discussing their problems with a stranger. DeepWell DTx aims to change that by bringing mental health therapy to the masses – especially hard-to-reach patients – through gaming. Co-founders Ryan Douglas and Mike Wilson speak about why games are a great way to treat mental health issues – if you get the formula right. Why did you decide to start DeepWell now? We found that mental health came up constantly in our respective careers – Mike in gaming and Ryan in creating medical devices and therapies. We saw many people were missing the resources or help to treat disorders like anxiety and depression. We often talked about what we could do to address this unmet need, then the deepening mental health crisis alongside the Covid-19 pandemic pushed us to start DeepWell. What's DeepWell's philosophy? We put games and game developers first. There is no treatment without player engagement, so therapy must be embedded in a fun and engaging game. How has your team of 40 experts across gaming, science and mental health helped your success? Our diverse team is made up of professionals at the top of their fields. Neurosurgeons, lawyers, creative strategists and others all work in service of the game developer. Without the game's fun, there is no therapy. What can players expect might change after playing your games? Our games aim to help players improve their physical and emotional functioning. After playing consistently, you should notice greater resilience and capability to handle the stress and anxiety of daily life. How has gaming supported your mental health? Which games do you recommend for therapy? At the moment we're focused on virtual reality (VR,) using games like Pistol Whip and motivational fitness apps like Supernatural for leisure and exercise. These games have especially helped during the pandemic for getting off the couch and quelling anxiety with movement. We've also found immersive fantasy games like Lorne Lanning's Oddworld and American McGee's Alice, role-playing games (RPGs) like Wizard101 and world-builders like Minecraft therapeutic for us and our families. Any game that takes you out of your head has potential benefits. Who are your customers? Are businesses investing in these games, such as the healthcare industry, or any business hoping to improve employee wellbeing? We're reaching out directly to folks with mental health issues. We also partner with game developers, publishers and platforms to create new games or repurpose games that are already therapeutic. We hope our games will make mental health treatment accessible to a broader audience. Serious games have evolved as a genre in recent decades, especially in academia and healthcare. Do you align with it? We are not serious games. We rely on the power of play and engagement that good games provide. While we see the value of other approaches, this is what makes us different. How will your FDA games certification project benefit the industry and gamers? Being able to make claims and develop games with therapeutic intent, and to have players understand the therapeutic benefit of engaging, will change game development and the audience games can reach. Can you tell us about games you plan to launch? The first game we're working on focuses on addressing stress, anxiety and symptoms of depression on a VR platform. More to come closer to launch. How will you keep your products secure and safe for users? We closely follow the FDA and HIPAA guidelines and requirements for data management in prescription games. What will success look like for DeepWell? Widespread recognition of the power of game developers to develop Immersive Medicine and being able to produce many therapeutic options for a range of cultures and mental health conditions.

Report: Three steps to superior cybersecurity

  • Enterprise cybersecurity
  • min read
    • The threat of cybersecurity weighs heavily on enterprises now more than ever. Technology researchers Gartner say new ransomware models alone are the biggest emerging risk organizations face today — bigger than the pandemic and supply chain disruption. But new research from Kaspersky in association with Longitude, a Financial Times company, shows enterprises are not prepared. Less than one in 10 are very well prepared to deal with cyberattacks by professional cybercriminals (9  percent,) lone hackers (7 percent) and nation states (6 percent.) The research surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. Respondents, representing companies from many regions and industries of at least 1,000 employees, were those who knew their organization's cybersecurity strategy. Enterprises unprepared for cyberattacks "Most people are completely unprepared," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "Every day, something changes: There's a newer, better virus, a new technique, a new modus operandi. It's impossible to keep up with everything, and that's frightening for everyone." Delaney is more prepared than most, with her company's security credentials and her background at the Defense Intelligence Agency conducting clandestine intelligence operations around the world. According to Kaspersky's research, the main reason companies are not prepared is reliance on legacy technology vulnerable to today's threats. They also lack financial resources to recruit or consult skilled security professionals. The risk is real, and companies are not prepared. What can they do? Kaspersky's research shows three things they can change for better security outcomes. Step 1: Make cybersecurity teams more diverse Diversity and inclusion is high on the business agenda, thanks partly to movements like #MeToo and Black Lives Matter. There's also a strong business case for it. Research by management consultancy McKinsey & Company shows companies in the top quartile for gender diversity on executive teams were 25 percent more likely to have above-average profitability than those in the bottom quartile. Businesses expect cybersecurity to benefit from diversity too. In Kaspersky's research, most enterprises (62 percent) believe creating a more diverse and inclusive cybersecurity team will be important in the next two years. They're right to focus on this because there's a long way to go. Figures from the UK National Cyber Security Centre show 85 percent of professionals working in cybersecurity are white and 66 percent are male. Kaspersky's research finds cybersecurity teams benefit from being more diverse and inclusive. A fifth (20 percent) of respondents strongly believe they're actively improving diversity and inclusion in their cybersecurity teams. The data shows this small group, which Kaspersky calls the Diversity Leaders, is much better prepared to deal with a range of cybersecurity attacks. Kaspersky's Diversity Leaders have also been quicker to learn from the pandemic. They are more likely than others to be planning for a major crisis through real-world cyberincident training (68 percent of Diversity Leaders versus 54 percent of the rest.) There are more than three million unfilled positions in cybersecurity globally, according to cybersecurity professional organization (ISC)². Darren Argyle, group chief information security risk officer at international bank Standard Chartered, believes improving diversity on teams can help fill vacant spots. In 2021 Standard Chartered launched its Cyber Acceleration Programme (CAP.) About 50 women have participated so far. A 'skill-up and scale-up' program, CAP provides junior and mid-level women with self-paced modules on cybersecurity and leadership. On top of the learning modules, groups of up to ten women are assigned to senior cybersecurity leaders and undergo a 12-week mentoring program. "We're creating a leadership framework that women can engage with," says Argyle. "They work with role models in the bank, who are predominantly women, on areas they might want to develop." Step 2: Closely integrate the C-suite with cybersecurity teams C-suite (senior management) leaders have broad and high-level remits, while cybersecurity professionals focus on the details of cyberthreats. They are not obvious partners. But Kaspersky's research shows that when enterprises build strong links between the two, they experience better security outcomes. A quarter (26 percent) of respondents believe strong integration between the C-suite and cybersecurity teams will be very important in the next two years. The data shows this small group, which Kaspersky calls the Integration Leaders, is better prepared to deal with cyberattacks. UK IT giant Softcat closely aligns its C-suite and cybersecurity teams. Responsibility for risk — including cybersecurity — ultimately rests with its CEO, Graeme Watt. "I am the key stakeholder for security within the board. I have a Chief Information Officer (CIO) who reports directly to me, and the information security team sits under them," he says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity risk." The company faces scrutiny of its cyber risk status from many sources. As a public company, it is subject to external audit. It has its own internal audits. As an IT company that offers security products and services, its reputation among customers depends on its own security standards. Watt works closely with its cybersecurity team to ensure standards are met, but elsewhere in the Softcat C-suite other leaders also have responsibility for cybersecurity. Indian manufacturer Shriram Pistons and Rings takes a similar approach and keeps its security expertise close to the C-suite. 'Shop floor' digitization is a priority for the company, and it plans to use the internet of things (IoT) extensively across its facilities. Its chief digital officer Prashant Khairnar, hired to drive digitization from 'shop floor to top floor,' explains that the leadership team takes security seriously. "When we do risk assessments, cybersecurity is always the top concern," he says. "Of course, I am not a cybersecurity expert, but the person who handles this area is, and he reports directly to me. I take a more strategic view, and he focuses on day-to-day security and the technical issues." Cybercrime is increasing rapidly. Data from technology market analysts Canalys shows 30 billion data records were stolen globally in 2020 – more than the previous 15 years combined. Evgeniya Naumova, executive vice president of corporate business at Kaspersky, says the rise in cybercrime has made the C-suite wake up to the threat. "I think the importance of information security was highlighted to the C-suite and top management during the Covid-19 pandemic," she says, suggesting the increased security risks of remote working captured leaders' attention. "There was a switch — a really obvious switch — in their minds. They understood that it's not just something to observe from afar — it needs to be top of their minds." Step 3: Invest in high-quality cybersecurity training It's no secret that a skilled cybersecurity team is essential to fighting cybercrime. But with four million unfilled vacancies in cybersecurity globally, there is a major skills shortage. A third (34 percent) of companies in Kaspersky's research believe the shortage will get worse in the next two years. Skills and training programs help fill this gap. But to stay relevant, these schemes must be kept up to date. The Kaspersky research identifies a very small group of companies, eight percent, that strongly believe their cybersecurity training programs can keep pace with the evolving threat landscape. The data shows this group, which Kaspersky calls the Skills Leaders, has better security outcomes. Continuously updating skills and training programs eventually helps to make security part of the company's culture. This is essential, according to Vaillance's Delaney. And she thinks continuous training on basic cybersecurity principles is a good place to start. She continues, "Employees need to keep their software up to date, understand what the VPN is and how to use it and not use public Wi-Fi, for example. These are general cyber hygiene best practices critical to maintaining security." Kaspersky's Skills Leaders are more likely to innovate around their training. Two-thirds of Skills Leaders (67 percent) believe it will be very important to carry out immersive cybersecurity training in the next two years, compared with just 49 percent of the rest. The Skills Leaders are also more likely to embed cybersecurity awareness into their recruitment and onboarding process. Another innovative way to fill the skills gap in cybersecurity teams is to recruit from competitors, according to Standard Chartered's Argyle. But to do this, companies must adapt how they work. "If you look at the skills we want to try to attract into organizations around cybersecurity and technology, a lot of those skills don't necessarily sit in another bank," he says. "They sit in fintechs, technology organizations and cloud companies. So we need to be able to offer the same working environment as a large technology company like Google, Amazon or a fintech. And that's a very different way of working." Kaspersky's Naumova says security is every employee's responsibility. "We offer educational courses on how to change the behavior of everyone in the company," she says. "It's not just something the information security team should care about. It's the responsibility of everyone." She adds that companies must take a top-to-bottom approach to security, so everyone learns. "Some companies have an information security director or similar on their board," she says. "They promote them there because they understand they can lose business in a single day if security isn't done properly." The three steps create a virtuous cybersecurity circle Kaspersky's research shows enterprises are better prepared against cyberattacks if they increase diversity in cybersecurity teams, improve collaboration between the C-suite and cybersecurity teams, and invest in quality skills programs. But developing these in isolation is not the answer. The research shows each factor complements one another. For example, Kaspersky's Skills Leaders are more likely to create diverse and inclusive cybersecurity teams and integrate their C-suites and cybersecurity teams more closely. It's a virtuous circle that increases cybersecurity preparedness. The threat landscape is evolving quickly, and cybercriminals are becoming increasingly sophisticated. Businesses have no choice but to match sophistication with extreme preparedness.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries