2024网络安全重要趋势-Cybersecurity considerations 2024 -kpmg

Cybersecurityconsiderations2024

Technologyinnovationsdemand

strategicpragmatism.

KPMGInternational

/cyberconsiderations

Maki

Foreword

As2024unfolds,organizationalleaders,fromtheCEOdown,havemuchon

theirplates.Theyarecontendingwithdiversechallengesaroundachieving

sustainedgrowth,navigatingtheimpactandrisksofemergingtechnology,

andattractingandretainingtalent,tonamejustafew.Fortheirpart,Chief

InformationSecurityOfficers(CISOs)areincreasinglybeingviewedasproactiveco-stewardsoftheseongoingbusinessimperatives—notmerelythecavalry

leaderridingintosavethedayduringacrisis.

InourannualCybersecurityconsiderationsreport,adiversecross-sectionof

globalKPMGcybersecurityspecialistsexploreseightconsiderationsthatCISOsandtheirteamsareencouragedtoprioritizeinthecomingyeartosupporttheorganization’sbusinessgrowthobjectivesbymitigatingtheimpactofspecificcyberincidentsandreducingoverallcyberriskexposure.

Organizationsworldwidefacemanycybersecuritychallengesrequiringthe

implementationofcontrolstobuildandembedresilience,meetregulatory

mandates,andreduceoverallrisk.However,therapidemergenceofartificialintelligence(AI)asastrategictoolforbothlegitimateandnefariouspurposesisrapidlymovingupthelist.ThedemocratizationofAI—theseadvanced

technologysolutionsandmodelsarenowlargelyaccessibletoanyonewithacreditcardviathecloud—hasatoncerevealednewpathstovaluecreationandexposedsignificantpotentialrisks.AIisprovingtobeatrueorganizationalgame-changer,includingforsecurityteams.

ThisevolvingthreatlandscaperequiresorganizationsandtheirCISOstoview

securitythroughanew,morepragmaticlens.Morethaneverbefore,theymustbalancedatasecurityandprivacywiththebroaderobjectivesofthebusiness.

Fromacybersecurityperspective,theimpactsofsocietal,economic,political,andregulatorydevelopmentsaremoreconsistentlyfeltgloballytoday.The

simplereasonistheworldismoreconnected.Themostacuteeffectofthe

connectedbusinessecosystemcontinuestobewithinglobalsupplychains—forallpracticalpurposes,therearevirtuallynoregionsoftheworldthatare

isolatedanymore.

However,thereremainlocalnuances.Forexample,thereareregulatory

requirementstowhichbusinessesmustadherethatremainuniquelyregional,suchascertainmarketsbeingmoresensitivetotheprotectionofpersonaldataandnewrulesaroundresponsibleAI,criticalinfrastructureandsupplychains.

There’saglobalfocuswithinthecybersecurityuniverseoncompliancein

general,witharefinedeyetowardtheoverallburdenofregulation,aswellas

thediversityofvariousreportingrequirements.Asaresult,companiesare

puttingmoreemphasisonembeddingprivacyandsecuritywithinthewaytheycomplywithabroadrangeoftrans-borderregulatoryrequirementsandregimes.

ThisisofparticularinterestwhenitcomestobuildingandgoverningresponsibleAIsystems,ensuringcustomerprivacy,andenactingguidelinesaroundcriticalinfrastructure,supplychains,smartproducts,andresilience.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20242

Maki

Atthesametime,cybersecuritybudgetsmayhavetobemoreobjectively

justifiedmovingforwardasorganizationsdealwitheconomicuncertainty.ManyCISOsareseeingflatbudgets,notnecessarilyreduced,assomeofthatspendisdivertedtoorganizationalinnovation,particularlyAIandautomationsolutions.Thisnoteworthydevelopmentrequiressecurityteamstoengageintechnologyrationalizationandbudgetoptimization—essentially,doingmorewithless.

Whileeconomicheadwindsdrivebudgetpressures,thereisagrowing

viewthatcybersecurityhasmaturedtothepointthatorganizationscantriminvestment.Further,securityfunctionalityisnowembeddedwithinotherIT

andtransformationbudgetsratherthanbeingacentralbudgetprovision.Also,theshifttoacloud-basedsecurity-as-a-serviceapproachembedssecurity

costsintocompanies’broaderoperatingexpensesinawaywehaven’tseenpreviously.

Inthisenvironment,IencourageCISOstosharpentheircyberrisk

quantification(CRQ)process,whichhelpsexpresstheimpactofcybersecurityriskinfinancialtermsusingmathematicalmodelingtoillustrateriskthrough

measurablevariables.1LookingatriskthroughaCRQlenscaneffectivelydemonstratereturnoninvestmentandinvestmentprioritiestoleadershipandtheBoard,ensuringtheorganizationunderstandsthethreatfrombothtechnologyandfinancialperspectives.

Fundamentally,thisreportexploresfromvariousangleswhatisperhaps

thecentralaspirationforexecutivesacrosstheenterprise:keepingtheir

organizationsresilient.Bottomline,ifadataleakornetworkbreachoccurs,howquicklycantheorganizationresumeregularoperations,andhowcantheimpactoncustomersbeminimized?

Thisisemblematicoftheresilienceagendathatcanbeseenwithinmanyofthemostrecentlyproposedregulations,particularlythosefocusingoncriticalinfrastructuresectors.Inmanycases,theemphasisisnowonresponseandrecovery,aswellasmitigatingharmtocustomers.Thisisadifferentlens

throughwhichtoviewsecurityrelativetothetraditionalperspective.

Cybersecuritymustbeviewedasanever-evolvingongoingendeavor.Themoreorganizationsacceptcyberincidentsasinevitableyetmanageable,thebetter

theirchancesofachievingthatbalancebetweenpreparationandresilience.

AkhileshTuteja

GlobalCyberSecurityLeader

KPMGInternational

1Forrester,TheCyberRiskQuantificationLandscape,Q42022,November29,2022.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20243

01

03

05

07

020406

08

Eightkeycybersecurityconsiderationsfor2024

Clickoneachconsiderationtolearnmore.

Meetcustomerexpectations,

improvetrust

Withcyberthreatsanddataprivacy

concernsgrowing,CISOsshouldbeseeking

toworkcloselywithstakeholdersacross

theorganizationtomaintaintrustby

ensuringoperationsareresilientinthe

eventofanincident.

Navigateblurringglobal

boundaries

Acentralconsiderationthatorganizations

shouldexaminehowtomosteffectively

navigatetheincreasinglycomplexglobal

businesslandscapetoensureresilienceand

businesscontinuity.

Unlockthepotentialof

AI—carefully

Securityandprivacyleadersshouldbe

supportingthebusinessobjectivesreliant

onAIanddeterminehowtoharnessthis

game-changingtechnologyeffectively

andresponsibly.

Makeidentityindividual,not

institutional

Drivenbyexpandingbusinessmodels,it’s

vitalthatorganizationsnowviewidentity

notinisolationbutfromabroadperspective.

Embedcybersecurityand

privacy,forgood

Theactofembeddingsecurityacrossthe

organizationshouldbeviewedasanexerciseindrivingoperationalexcellence.

Modernizesupplychainsecurity

Despitethechallengesandcompeting

priorities,ensuringthesupplierandpartnerecosystemissecureshouldnotbea

bottleneck;itshouldbeabusinessenabler.

Superchargesecuritywith

automation

Asoperatingmodelsdigitize,security

teamsshouldautomateandupgradetheirprocessestokeeppace.

Aligncybersecuritywith

organizationalresilience

Organizationsshouldfindawaytocreate

abroad-rangingcultureofresilientsecurity

throughouttheenterpriseandseektoensure

allstakeholdersareonthesamepage.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20244

Maki

Consideration1

Increasingtrustshouldbehighonthecyberagendainrelationtohowvideoandaudio

filesareusedinthecreationofdeepfakes,theimpactofwhichcanbegraveforprivacyandperhapsevendemocracy.

MikaLaaksonen

Partner

GlobalCyberSecurityESGLeader

KPMGinFinland

Meetcustomer

expectations,

improvetrust

Consumers,employees,suppliers—every

corporatestakeholder—expectbusinesses

topursuegrowthandprofits.Butincreasingly,

companiesareexpectedtooperateinasocially

responsiblemanner,aswell.Organizations

shouldstrengthentheconnectionbetween

securityandprivacyandenvironmental,social,

andgovernance(ESG)factors.Thisbondisbeing

increasinglyrecognizedacrossthebusiness

ecosystem,particularlybyESGratingservices

astheysearchforgreatertransparencyin

measuringandcomparingorganizations.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20245

Maki

TheimportanceofESGandhowsecurityandprivacyfitintothebiggerpicture

AccordingtotheKPMG2023

CEOOutlook

,69percentofCEOshaveembeddedESGintotheirbusinessas

ameansofcreatingvalue,and50percentanticipatesignificantreturnsfromthoseeffortsoverthenextthreetofiveyears.

WhileenvironmentalaspectsoftheESGagenda

havegarneredthemostattention,governance

elementssuchascybersecurityandprivacyareless

well-developed.Withcyberthreatsanddataprivacy

concernsgrowing,CISOsneedtoworkcloselywith

theirESGcounterpartstoensurethat,intheeventofanincident,operationsareresilientandcontinuityplansarereadyforactivation.

Byembeddingcyberandprivacyconsiderations

intosocialresponsibilityprogramsandprotecting

customerdata,organizationscanincreasethechancesofmaintainingtheirreputationsandtrustamong

customers,evenintheeventofamajorbreach.

Forconsumerswhosharepersonalinformation

withpublicandprivateserviceproviders,thereisanexpectationthattheirdatawillbeprotectedandthatitwillnotbeusedforpurposesotherthanwhatthey’vesupplieditfor.

Atthesametime,there’sanexpectationthat,inthepursuitoftheirbusinessobjectives,organizationswillactinasociallyresponsiblemannertoreducetheir

carbonfootprint,supporttheirlocalcommunities,

improvelaborpolicies,andensureworkplacediversityandequality,tonamejustafewitems.

AddressingcybersecurityandprivacyspecificallyandESGbroadlyhavebecometopcorporateand,byextension,CISO,priorities.Therearedifferentregulationsforspecificregionsandindustries,andthoseguidelinesneedtoengendertrust.Thisis

importantfromacomplianceperspectivebutalsonoteworthybecauseB2BcustomersandB2C

consumershavediscreteexpectationsdirectly

impactedbythevariousrules.

Individualconsumerscanpurchasealternative

productsorservicesifthey'renothappywiththe

provider’sactionsregardingtheirpersonaldata,

privacyandresponsetobreaches.Infact,82percentpreferabrand’svaluestoalignwiththeirown,and

75percentsaidtheywouldabandonabrandoveraconflictinvalues.2Givenachoice,mostconsumersprefercompaniesthatprioritizesecurity,privacy,andsustainabilitybyadheringtoESGstandards.

ThisisespeciallytrueontheB2Bside,wherecorporatecustomersvaluesafeguardingtheirconfidentialdata

andintellectualproperty.Moreandmoreindustries

haveregulatoryrequirementsforcybersecurityand

dataprivacy,andorganizationsthatcomplywiththeseregulationsarepreferredbystakeholders.3Formany

organizationsoperatinginB2Bindustries,thisismorethana“nicetohave,”withregulatoryobligations

flowingdirectlyfromfirmsinregulatedindustriesto

theirsuppliers,whocouldbetarnishedbyassociationifthebrandexperiencesasignificantcyberevent.

Indeed,roughlytwo-thirdsofconsumerswillpaymoreforsustainableproducts,althoughtwo-thirdsofretail

executivesareskepticalthattheyactuallywillpaymore.4However,whileconsumersmaybeokaywithpaying

extraforsecurity,privacyandsocialresponsibility,thesefactorsare,forthemoment,“tablestakes,”thecost

ofdoingbusiness,althoughtheyarelikelytohitthebottomlinesoonerratherthanlater.

Incasesinvolvingprivateequityorventurecapital,

theethicallensthroughwhichthesefirmsviewtheir

investmentsisworthnoting.Manynowlookfor

assurancesoftheappropriatelevelofcybersecurity

andprivacymanagement.Ultimately,they'reconcernedaboutthebranddamagecybereventscanbringtotheorganizationswheretheyinfusefunds.

Increasingly,there'sabigroleforcyber

toplayregardingAIanddataethics.

DeterminingthatthedatausedtotrainAI

algorithmsisaccurate,hasn’tbeencorrupted,andisfreefrombiasisaherculeanand,

perhapsultimately,impossibletask,butwellworththeeffort.

CarolineRivett

Partner

GlobalCyberSecurityLifeSciencesLeader

KPMGintheUK

2GoogleCloud,“Newresearchshowsconsumersmoreinterestedinbrands’valuesthanever,”April27,2022.

3KPMG,CybersecurityinESG,2023.

4FirstInsight/WhartonSchooloftheUniversityofPennsylvania,“TheSustainabilityDisconnectBetweenConsumersandRetailExecutives,”January2022.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20246

Maki

ThesocialbenefitsofactivelyembeddingcybersecurityintotheESGagenda

ThescopeoftheESGdialogueneedstobebroadened—atmanyorganizations,it'snotyetcommontobetalkingaboutcybersecurityandprivacyinthecontextofESG.

Intoday’senvironment,therearedeepissueswiththesocialcontractbetweenorganizations,employeesandconsumersrelatingtodataprotection.Increasingtrustshouldbehighonthecyberagendawhenitcomes

tohowvideoandaudiofilesareusedinthecreation

ofdeepfakes—imagery,video,oraudiofeaturinga

specificindividualthatisreplacedwithanotherperson'sfaceorvoiceormanipulatedtogivetheimpressiontheindividualdidorsaidsomethingtheydidnot.

Deepfakesaredifficulttocombatsince,inmany

instances,it’suptotheaudiencetointerpretwhetherthevideooraudioisrealorfraudulent.Organizationsmustbevigilantaboutidentifyingandremovingthesefilesandshouldparticipateineducatingthebroader

publiconthesubject.Increasingly,there'sabigroleforcybertoplayregardingAIanddataethics.DeterminingthatthedatausedtotrainAIalgorithmsisaccurate,

hasn’tbeencorrupted,andisfreefrombiasisa

herculeanand,perhapsultimately,impossibletask,butwellworththeeffort.

Privacyandcybersecurityalsoplayvitalrolesin

protectingfreedomofspeechandsecuringtoday’s

proliferatingdigitalcommunicationschannels.

Privacycontrolscanalsoplayakeyroleinlimitingtheexploitationandmisuseofpersonalinformationwithoutconsentorknowledge.Thisisvitalinmaintainingthe

publictrustinorganizations.

ManydecarbonizationandCO2reductionprograms

relyondigitaltechnologiesandautomatedsystemsto

monitorandmanageenergyproduction,distribution,andconsumption.Asefficientasthesetoolscanbe,they

canalsocreateunforeseencybersecurityvulnerabilitiesandrequireahighlevelofdataprotection.Strategicallyembeddingcybercanhelpmitigatethreats,reducetheriskofdatabreachesandensureregulatorycompliance.

Finally,there'sasubstantialsocialresponsibility

dimensiontobothcybersecurityandprivacywhereorganizationsshouldworkwithB2CandB2B

customerstohelpthembemorecyberaware.Banksdoitroutinely,andretailersaredoingitmoreand

more.There’salsoaconnectiontosupplychainandecosystemsecurity,whereimprovingthesecurityofthevendorecosystemiscritical.

Dopeoplereallycarewhetherabusinesshasacyberincidentifit’smanaged?

Theoretically,mostpeoplewouldprobablysaythattheydon'twantacompanywhoseproductsorservicestheyusetosufferadatabreach.Butthosesamepeopledon'twanttopaymoreandwanttouchpointstobequickand

frictionless.Peoplelargelydon'tcareuntilsomethingbadmaterializes,anditseemsasthoughtheywanttheworkofsecuritytohappen“behindthecurtain.”

Abigpartoftheequationisdemonstratingtocustomersthatcybersecurityisanorganizationalimperative—it

simplyistherightthingtodo.Organizationsshould

approachthisasthoughtheyaretrainingtheircustomersandclientstounderstandandcareabouttheimplicationsofcyberawarenessandprovethatwhatthey'redoing

isn’tjustanotherto-doitembutavitalservice.

Trainingpeopleoutsideyourorganizationisitselfan

exerciseinESGmaintenance.CybersecurityAwarenessMonthisanexampleofhowgovernmentandbusinessesworktogethertoensurethatemployeesandconsumersappreciatethebasicsofcybersecuritytoavoidthemostobviousrisks.

Thereisnosuchthingas100percentsecurity.Despitealltheprecautions,incidentsdohappen.Intheeventofacyberincident,makeaquickdecisionaboutwhetheryouneedtodisclosewhathappenedand,ifso,howmuch

informationyou’reprepared—orcompelled—toshare.5It'svitaltobeopenandhonest;goodcommunicationcanleadcustomerstotrustanorganizationevenmorethantheymayhavebeforetheincident.

5KPMGInternational,“Maintainingcybervigilanceandstayingresilient,”2023.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20247

Suggestedactions

Connectwithyourorganization’sESGteamtodeterminewhether

theyconsidercyberakeyaspectoftheirmandate.Ifnot,worktobuildawarenessofhowandwhyit’simportanttoallthreeareasofESG.

Bepractical.Effectivecybersecurityisnotasmuchaboutgettingbusiness

partnerstodothingsdifferentlyasit’saboutreframingtheconversationacrosstheenterprisetoinspireotherareasoftheorganizationtoinfusesecurityintowhattheyalreadydo.

SharpenyourglobalregulatoryintelligencearoundcyberingeneralandESGandprivacyinparticulartoensuretimelycomplianceandreporting;keeptrackof

andremainfamiliarwithever-increasingregulationsandtheireffectsonyourcyberefforts.

Maki

1

lihnrorysgbialieenrniszciiyl

Cybrsgies

Learnmore

CybersecurityinESG

It'stimetoviewESGandcybersecuritythroughthe

samelens.

KPMGglobaltechreport:ESG

HowbusinessescanusetechnologyasanopportunitytotackletheirESGambitions.

Roadtoreadiness

KPMGESGAssuranceMaturityIndex2023.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20248

r

Maki

Consideration2

Embed

cybersecurity

andprivacy,

forgood

Security,fromtheCISOdownthroughtheir

entireteam,isaverydifferentroletoday.Cyber

isbecomingmoreembeddedincorebusiness

processes.Thatrealityisbeingreflectedinamoveawayfromacentralizationofcybersecurityinthe

CISOroletoafederatedmodel,inwhichtheCISOistheconductoroftheorchestra,establishing

theframeworks,assessingrisk,andproviding

implementationsupport.Securityisintegralto

everyfunctionacrosstheorganization,fromfrontofficetoback,andmanyleadersnowacknowledgethevalueofintegratingasecuritymindsetintotheirverydifferentbusinessculturesandprocesses.

©2024CopyrightownedbyoneormoreoftheKPMGInternationalentities.KPMGInternationalentitiesprovidenoservicestoclients.Allrightsreserved.Cybersecurityconsiderations20249

r

Maki

Businessmodelsandtechnologyarechangingandimpactingsecurity

Whetheryoumakeawidget,deliveraservice,orcreateinformation,operatingmodelsareincreasinglycloud-

based,which,inconcertwithothernewtechnologies,isbeingusedtoincreasescalability,reducecosts,generaterevenue,andwidenprofitmargins.

Theautomotiveindustryisagoodexampleof

transformingbusinessmodels.Carstodayhavebecomehugetabletsonwheels.Peopleareorderingpizza

fromtheroadandnotevenusingthephone.Somuchtechnologyhasbeenaddedtogas-poweredcars,nottomentionelectricvehicles,thattheyhavebecomearguablythemostsophisticatedproductavailabletoretailconsumers.

Thedownsideoftechnologyisitwidenstheattack

surface,creatingnewpotentialvulnerabilitiesand

increasingthecomplexityoftheecosystemwithwhichCISOsmustcontend.Atthesametime,thecostof

cybersecurityisskyrocketing,leadingorganizationstoconsiderbetterstrategiesfordeliveringthoseservices.

Inthisnewworld,organizationscan'tdeployhundredsofpeople;securityteamsmustbelean—particularlythoseembeddedwithinbusinesslines.Organizationsmustfindtherightcombinationofpeopleandtechnology,usingAIingeneralandmachinelearninginparticulartocoverthegroundhumanscan’tcoverefficiently.

Performingtimelysolutionreviewsonthousandsofapplicationsissimplyimpossibleforhumans.

Organizationsmustdecidewheretostartincorporatingsecuritywithinapplicationdevelopmentprocessesandmovetocontinuousmonitoringtounderstandtheimpactofpotentialattacksandvulnerabilities.

Theironyisitdoesn'ttaketheCISOtodothat.Managingtheserisksrequiresaculturalshiftacrossthebusiness

toembracesecurityaspartoftheorganization’sstandardoperatingprocedures.CISOsdon'tinstallpatches,and

theydon'tmanageoperations.Securityteamsshould

determinehowandwheretoembedcertainsecurity

tasksinthebusinessandmonitorthosetaskstoensuretheyarecarriedoutproperly.Thisishowweseesecurityteamsevolving.

It'sgoingtobeamatterof“insourcing”tonudge

securityclosertothecustomeroroutsourcingtoathird-partyserviceprovidertoefficientlyleveragespecializedskillsthatmaynotexistwithintheorganization.Many

organizationsstrugglewiththeideaofsecurityasacorecompetency,particularlyastheyattempttomasterthesheervolumeofnewtechnologies.

Workwithbusinessleaderstoembedsecurityeffectively

There’salotoftalkabout“shiftingleft,”butwhileweacknowledgetheimportanceofconsideringsecurityearly,wealsobelieveorganizationsmustlookend-to-end—fromconcepttobuildandincludingcontinuousmonitoring—andapproachsecurityasanongoing

requirement.Throughoutthatjourney,thenumberoneelementofsecurityisvisibility.

Securityprofessionalsarebecomingmorelikeairtrafficcontrollers,andtherunwaysmustbekeptclear.CISOsmustmakesure“traffic”—thatis,applications—arecominginandgoingoutefficientlyandsafely.Securityshouldn’tholdupthereleaseofproductsandservices,butthereshouldbeearlyvisibilityintotheprocesses

thebusinessisemploying.

Embeddingsecurityintobroaderbusinessshouldbe

viewedasanexerciseindrivingoperationalexcellence.Securityteamsshoulddescribeanddemonstrate

what“good”lookslikeandinspireembeddedsecurityprofessionalsacrosstheenterprisetomanagetowardthatvision.It’samatterofestablishingappropriate

guardrailstoenableasecure-by-designapproachtobeembedded,andthenintegratingtherighttoolingandtemplatesintodevelopmentenvironments.

CISOsandtheirteams—aswellassecuritypersonnelwhoareembeddedinthebusiness—shouldtakea

holisticapproachtooperationalexcellenceandsharedresponsibility.Thismeansgivingequalconsiderationtopeople,process,technology,andregulatory

requirements.Byfocusingonriskmanagement,incident

Tenor15yearsago,the80/20rulefor

securityprofessionalswas80percent

technicalskillsand20percentsoftskills.

IfCISOswanttoensuretheyarenot

perceivedassupportstaff,theymustget

comfortablewiththenew80/20