MIGUEL GARCIA-MENENDEZ itti The [Digital] Accountability Think Tank Spain

Transcription

1 MIGUEL GARCIA-MENENDEZ Spain Former control engineer and management consultant for some 20 years Currently runs Former member of the Board of the Industrial Cybersecurity Center

2 An [almost] global Industrial Cybersecurity regulatory landscape Kaspersky Lab s 6th Industrial Cybersecurity Conference Sochi (Russia). September, 20th, 2018 itti Miguel Garcia-Menendez (ES) Co-Founder & Chairman itti The [Digital] Accountability 2

3

4 Miguel Garcia-Menendez Co-Founder & Chairman A 2+ decades career veteran, Miguel s first job was in the steel Industry as Head of MES & HMI at an engineering firm, where he soon became CIO. This let him know, first hand, the problems bound to Information/Operational Technology integration. He has also been a consultant, auditor, lecturer and popularizer in management consultancy firms, universities and forums from which he has helped other executives to fulfill their digital obligations. Today, Miguel aims to help corporate Directors & Officers to understand their digital cyber accountability. You can follow Miguel s professional interests as well as his musings via his

5 @ittiresearch 5

6 @ittiresearch 6

7 Novorossiysk 7

8 Novorossiysk (RU) Gijon 8

9 Gijon (ES) Novorossiysk 9

10 @ittiresearch 10

11 Musing #1 Are we going to have a digitally-transformed industry to 11

12 THE digital industrial 12

13 Prof. Thomas H. Davenport Prof. George 13

14 32, GE's stock price (USD) 24, 16, 8, , 9/19/11 1/9/12 4/30/12 8/17/12 12/10/12 4/3/13 7/23/13 11/8/13 3/4/14 6/23/14 10/10/14 2/2/15 5/22/15 9/11/15 12/31/15 4/22/16 8/11/16 11/30/16 3/23/17 7/13/17 10/31/17 2/22/18

15 Mr. John Flannery Mr. Jeffrey R. 15

16 Provocation #1 Security is hardly digitally-transformed Industry s 1st challenge. [Neither 16

17 Provocation #1 (cont.) The economy, the desirability of your products & your investors patience 17

18 @ittiresearch 18

19 @ittiresearch 19

20 digital 20

21 df= f(digital Density) = f(digital Dependence) = f(dd, lack of 21

22 digital Fragility Quality of an organization that determines its susceptibility to suffer an incident, of digital nature, which disturbs its activity (besides causing other consequences for people, assets or the environment); and of whose possible materialization there is not always 22

23 Musing #2 Protection: everyone s primary [& primitive] 23

24 Fort 24

25 National Cyber Security Strategies (CSS) Australia Austria Bangladesh Belgium Canada Colombia Costa Rica Croatia Cyprus Czech Republic Denmark Dominica Egypt Estonia Finland France Gambia Germany Ghana Hungary India Ireland Italy Jamaica Japan Jordan Kenya Latvia Lithuania Luxembourg Mexico Montenegro Namibia New Zealand Nigeria Norway Paraguay Peru Poland Qatar Romania Russia Rwanda Saudi Arabia Singapore Slovak Republic South Africa South Korea Spain Switzerland The Netherlands Trinidad and Tobago Turkey Uganda UK USA Zimbabwe Source: ENISA, European Network & Information Security 25

26 Provocation #2 «NATIONAL»? Think 26

27 National Cyber Security Strategies (CSS) Australia Austria Bangladesh Belgium Canada Colombia Costa Rica Croatia Cyprus Czech Republic Denmark Dominica Egypt Estonia Finland France Gambia Germany Ghana Hungary India Ireland Italy Jamaica Japan Jordan Kenya Latvia Lithuania Luxembourg Mexico Montenegro Namibia New Zealand Nigeria Norway Paraguay Peru Poland Qatar Romania Russia Rwanda Saudi Arabia Singapore Slovak Republic South Africa South Korea Spain Switzerland The Netherlands Trinidad and Tobago Turkey Uganda UK USA Zimbabwe Source: ENISA, European Network & Information Security 27

28 Provocation #2 (cont.) and stop calling your CSS «NATIONAL», in a borderless [cyber] 28

29 @ittiresearch 29

30 [almost] global BE NL CN DE PT SG ES RO ZA US FR TR IT UK [ RU ] 30

31 not an easy task! DOCUMENTS 31

32 STRATEGIES REGULATIONS 32

33 CS strategies 33

34 avoid the I-want-my-own-strategy presidential syndrome Until recently [May, 15 th, 2018], the US had no specific formal cybersecurity strategy [despite having been a CSS pioneer in 2003]. There have been several public policies, instead. Russia started its InfoSec journey in An updated doctrine was approved in 34

35 an example for the rest of us Germany, The Netherlands, Turkey, the UK and the US, the most veteran countries (more than 1 iteration) in developing CSS s. Russia introduced the concept of Cyber Security Strategy for the first time in a draft released in 35

36 corporate directors are not in the policy-makers agendas Only Spain, The Netherlands, Turkey and the UK have specific objectives or actions targeting BoD s members w/in their CSS 36

37 ICS cybersecurity is not in the policy-makers agendas The Netherlands, Romania, Turkey and the US s CSS do not include specific mention to Operational Technology at all. Russia s InfoSec doctrine does not include any reference to ICS cybersecurity, 37

38 CIP regulations analyzed [pre-eu NIS 38

39 less regulation, better regulation might apply here A specific regulation rules CIP in every country, except for The Netherlands and the UK. The EU NIS Directive has come to change this. Russia started its CIP journey in the early 2000s. Today Russia s CIP policy is part of its national security 39

40 another example for the rest of us Romania and Turkey (again) are among the most veteran (2010) countries when it comes to formally define their CIP 40

41 would less disparity benefit interdependencies someway? Italy and Portugal have opted for extrictly following EU s CIP Directive of Their critical sectors are only energy & transportation. A situation that the EU NIS Directive has come to 41

42 The post-eu NIS Directive picture BE NL CN DE PT SG ES RO ZA US FR TR IT UK [ ] RU COUNTRIES affected [w/in our 42

43 The post-eu NIS Directive picture Source: European Commission BE NL DE PT ES RO FR UK IT as of May, 9th, 2018 COUNTRIES complied [on due 43

44 The post-eu NIS Directive picture 17 out of 28 COUNTRIES were urged to transpose the NIS Directive [on July, 20th, 2018] Source: European 44

45 The post-eu NIS Directive picture Source: European Commission BE NL DE PT ES RO FR UK IT as of today. COUNTRIES still 45

46 Musing #3 Are companies taking cybersecurity 46

47 National Cyber Security Strategies (CSS) Australia Austria Bangladesh Belgium Canada Colombia Costa Rica Croatia Cyprus Czech Republic Denmark Dominica Egypt Estonia Finland France Gambia Germany Ghana Hungary India Ireland Italy Jamaica Japan Jordan Kenya Latvia Lithuania Luxembourg Mexico Montenegro Namibia New Zealand Nigeria Norway Paraguay Peru Poland Qatar Romania Russia Rwanda Saudi Arabia Singapore Slovak Republic South Africa South Korea Spain Switzerland The Netherlands Trinidad and Tobago Turkey Uganda UK USA Zimbabwe Source: ENISA, European Network & Information Security 47

48 # of countries that already have their own CSS out of Source: ENISA, European Network & Information Security 48

49 Provocation #3 25% of countries already have a CSS! Does companies 49

50

51 Source: #QuoteBroughtBy Although ultimate responsibility for cyber security within a company lies with the CEO, it would be highly unusual for the CEO of a company to have to resign over an attack. UK Parliament (@UKParliament) House of Commons Culture, Media & Sport Committee Cyber Security: Protection of Personal Data Online

52 Oil & Gas CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 52

53 Air Transport & Aeronautics CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 53

54 Digital Security CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 54

55 Financial Services CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 55

56 Healthcare CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 56

57 Public Sector CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 57

58 Retail CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 58

59 Leisure & entertainment CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 59

60 Automotive CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 60

61 Policy Making CCI itti Industrial The [Digital] Cybersecurity Accountability Center Think Tank 61

62

63 Digital is not my 63

64 Who s been 64

65 @ittiresearch 65

66 sometimes it's OK to admit to your 66

67 We thought we were taking it [cybersecurity] seriously, outside experts were telling us we were taking it seriously. Patently we weren't taking it anything like seriously enough. One thing I think I know more keenly than any other British CEO is that every single one of us is underestimating the importance of 67

68 CG codes 68

69 does it make sense? Corporate Governance codes are mandatory, while its recommendations are not ( comply-or-explain principle). Exception: US (the Sarbanes- Oxley Act of 2002 is not a code, it is a 69

70 shouldn t every Audit/Risk Committee act early, too? Risk oversight is BoD s biz (usually through an Audit or Risk Committee). Turkish listed companies have an Early Detection of Risk Committee. In the case of Russia, its Corporate Governance Code also reffers to an Audit 70

71 this probably explains everything Only The Netherlands and South Africa s CG codes make an explicit mention to cyber [despite almost all of them were released after the TARGET case (2013)]. Of course, none of them mentions industrial 71

72 Provocation #3 (cont.) Definitely, it seems that companies are not taking cybersecurity 72

73 Good news a change of behaviour: the Cybersecurity Disclosure Act Sen. J. Reed (D) Sen. S. M. Collins

74 Good news a change of behaviour: the Cybersecurity Disclosure Act Sen. J. Reed (D) Sen. S. M. Collins (R) Sen. M. R. Warner (D) Sen. J. McCain

75 Good news a change of behaviour: the Cybersecurity Disclosure Act Rep. J. Himes (D) Rep. T. Rooney (R) Rep. G. Meeks (D) Rep. D. Heck

76 More good news a change of behaviour: the Cybersecurity Disclosure

77 itti Thank you very 77