The report challenges the traditional approach to managing security risks, which has typically fallen to the information security function, and recommends that organisations take a much more strategic and business-based approach to risk management. To take advantage of both technology and cyberspace, organisations must manage new risks beyond those traditionally covered by the information security function, including attacks on reputation and all manner of technology.
While individual threats will continue to pose a risk, there is even more danger when they combine, such as when organised criminals adopt techniques developed by online activists, said Steve Durbin, Global Vice President, ISF. Traditional risk management is insufficiently agile to deal with the potential impacts from activity in cyberspace. While executives recognise the benefits and opportunities cyberspace offers, their organisations must extend risk management to become more resilient, based on a foundation of preparedness. We are advising our members that this is the year of resilience and to be prepared to move at the speed of a Tweet!
Threat Horizon 2014 provides a practical place for organisations to start by providing a forward-looking view of the increasing threats in todays interconnected, always-on world. This in turn enables a better-prepared, strategic approach to managing and mitigating security risks.
The report identifies three main drivers and provides organisations with practical guidance on how to deal with increasingly complex threats including:
External threats that come from the increasing sophistication of cybercrime, state-sponsored espionage, activism moving online, and attacks on systems that have a physical impact in the real world, for example industrial control systems
Regulatory threats that come as regulators call for greater transparency about incidents and security preparedness, while increasing requirements for data privacy
Internal threats that come as technology introduces new benefits at a relentless pace and the business adopts them without fully understanding the risks.
The report also highlights 10 predictions under each of the three threat groups, along with the potential business impacts, and provides recommended actions at the end of each one:
External Threats
- Cyber criminality increases as Malspace matures
The cyber arms race leads to a cyber cold war
More causes come online; activists get more active
Cyberspace gets physical
Regulatory Threats
- New requirements shine a light in dark corners exposing weaknesses
A focus on privacy distracts from other security efforts
Internal Threats
- Cost pressures stifle critical investment
A clouded understanding leads to an outsourced mess
New technologies overwhelm
The supply chain springs a leak as the insider threat comes from outside
ISFs Durbin adds: From cyber to insider, organisations have varying degrees of control over evolving security threats. With the speed and complexity of the threat landscape changing on an almost daily basis, we are seeing businesses being left behind, sometimes in the wake of reputational and financial damage they need to take stock now to ensure they are fully prepared and engaged.
Threat Horizon 2014
The ISF Threat Horizon series of reports is aimed at both senior business audiences and information security professionals. These annual reports are designed to help organisations take a proactive stance to security risks by highlighting challenges in the threat landscape and identifying how the confidentiality, integrity and availability of information may be compromised in the future.
Threat Horizon 2014 contains detailed predictions along with trends and other factors that can increase or decrease the probability of the predictions coming true. An executive summary of the report is available from ISFs website www.securityforum.org . The full report will be available to non-Members for purchase from the ISFs online store beginning on May 1 and can be pre-ordered now at: https://store.securityforum.org/shop/.
Information Security Forum (ISF)
Founded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit association of leading organisations from around the world. It is dedicated to investigating, clarifying and resolving key issues in cyber, information security and risk management and developing best practice methodologies, processes and solutions that meet the business needs of its Members. ISF Members benefit from harnessing and sharing in-depth knowledge and practical experience drawn from within their organisations and developed through an extensive research and work program. The ISF provides a confidential forum and framework, which ensures that Members adopt leading-edge information security strategies and solutions. And by working together, Members avoid the major expenditure required to reach the same goals on their own.
