The FISMA Focus IPD

From: Corporate Counsel

By Catherine Dunn

As the U.S. natural gas pipeline sector and the Department of Homeland Security square off against malicious cyber intrusions aimed at companies, along comes yet another study that highlights serious governance shortcomings of critical infrastructure companies when it comes to cybersecurity.

“The Governance of Enterprise Security: CyLab 2012 Report” [PDF], released last week by Carnegie Mellon University, offers the first side-by-side comparison of industries on governance practices and cybersecurity oversight. Compared against the financial, IT/telecom, and industrials sectors, energy/utilities companies fared the worst.

“Of the critical infrastructure respondents, the energy/utilities sector had the poorest governance practices,” writes study author Jody Westby in Forbes (a co-sponsor of the survey, along with RSA). “When asked whether their organizations were undertaking six best practices for cyber governance, the energy/utilities sector ranked last for four of the practices and next to last for the other two.”

The energy/utilities sector responses, as reported by Forbes, broke down as follows:

• 71 percent of their boards rarely or never review privacy and security budgets.
• 79 percent of their boards rarely or never review roles and responsibilities.
• 64 percent of their boards rarely or never review top-level policies.
• 57 percent of their boards rarely or never review security program assessments.

The energy/utilities respondents also “placed the least value on IT experience when recruiting board members,” writes Westby, the CEO of the consultancy Global Cyber Risk.

Westby finds the energy/utilities results particularly troubling: “What is disturbing about these findings is that the energy/utilities sector is one of the most regulated industry sectors and one of the most important to business continuity,” she says. The sector is also heavily dependent on industrial control systems (known by the acronym SCADA), “most of which were not designed for security and have no logging functions to enable forensic investigations of attacks,” she adds.

The survey noted that overall, “the financial sector has better privacy and security practices than other industry sectors.” The financial sector got the highest marks on undertaking best practices, and respondents from those companies also indicated “they are much farther ahead in establishing risk committees” on the board: 78 percent said they had a risk committee separate from the audit committee, compared to 44 percent among industrials, 35 percent among energy/utilities, and 31 percent among IT/telecom.

The energy/utilities and the IT/telecom sectors were the least likely to review cyber insurance coverage—79 percent and 77 percent, respectively, said they did not do so. Meanwhile, 52 percent of financial sector boards and 44 percent of industrial sector boards said they didn’t perform a review.

But as the first round of CyLab survey findings published earlier this year revealed, governance around cyber risk is generally lacking. Despite holding extensive troves of digital assets—and bearing an explicit fiduciary duty to protect those assets—boards and senior management “are not exercising appropriate governance over the privacy and security of their digital assets,” according to the results.

These findings on board oversight dovetail with those of a 2011 study by the Center for Strategic and International Studies and McAfee, focused on power, oil, gas, and water companies around the world. That report, too, uncovered a similar dearth of preparedness.

“What we found is that they are not ready,” wrote the authors of last year’s “In the Dark: Crucial Industries Confront Cyberattacks” [PDF]. “The professionals charged with protecting these systems report that the threat has accelerated—but the response has not.”

Those threats, as reported by company executives, increased substantially from the previous year. In the 2010 survey, “nearly half of the respondents said that they had never faced large-scale denial of service attacks or network infiltrations,” according to the authors. By 2011:

• 80 percent of respondents said they had faced a large-scale denial of service attack.
• 85 percent said they had experienced network infiltrations.
• A quarter of respondents reported daily or weekly denial-of-service attacks on a large scale.
• Nearly two-thirds said that, on at least a monthly basis, they found malware designed for sabotage on their system.

How were companies responding to these vulnerabilities? While the authors found some improvement in the adoption of security measures by corporations, the bad news was that such improvement was moving along “at a snail’s pace.”

For example, the CSIS/McAfee study asked about 29 different security measures that can be used to defend company networks—including security technologies, security policy, encryption, authentication, and network connectivity. They found that security-measure adoption rates varied by sector:

The water and sewage sector, which had much lower than average rates of security measure adoption in 2009, improved markedly from 38 percent to 46 percent. Oil and gas executives reported adoption of 48 percent of available technologies, up from 45 percent the year before. And energy companies, which led the field in security adoption last year, largely rested on their laurels this year, increasing security measure deployment only a point, from 50 percent to 51 percent.

Yet the bottom line for corporate cybersecurity was still disappointing: “Most companies failed to adopt many of the available security measures. This means that, for many, security remained rudimentary.”