Surveillance deals with the act of carefully watching someone or something with the specific intent to prevent or detect a crime. A couple of decades ago that would have been a true definition as it related to protecting an enterprise against threats with limited capabilities and limited access to the enterprise. “Watching one thing” was sufficient. However, in our current technological state, that simple definition now involves more complexity and sophistication than ever before. The explosive growth of technological capabilities and people that can use them to probe, prepare and perpetrate an attack or criminal act against a geographically dispersed enterprise from thousands of miles away, undermines traditional surveillance strategies.
The role of the CSO has significantly changed in the past 10 years and will change even more drastically over the next 10. For example, mention “convergence” and lines begin to blur – lines demarcating previously clear-cut, albeit traditional areas of management responsibility, budgets, reporting hierarchies, resourcing needs and geography. Indirectly, it challenges the more nuanced elements of competence, corporate politics, decision making and information sharing.
Historically, the domains of physical/electronic security and information technology have been separated within the organization by mission, budget, hierarchy, culture and stakeholder bias. CSOs, CTOs, CISOs and the Chief Risk Management Officers can no longer perform their missions independently of one another. For an organization to survive, collaboration is required to effectively address the extraordinary challenges posed by the convergence of physical, cyber and insider threats.
On the Nature of Threat Convergence
It wasn’t that long ago when surveillance systems “watched” for traditional threats: the physical attack. Whether by air, land or sea, systems were developed, implemented and integrated so as to provide for the surveillance and alerting of identified external threats. But in today’s post-Web 2.0 world, the leading indicators of a physical attack may prove to be cyber-based.
Cyber-based threats defy the conventional perceptions of time, space, context and attribution, and thus challenge traditional approaches to surveillance. Unlike the physical threat charging the perimeter, a successful cyber attack can be accomplished without the victim’s knowledge of when, where, how or why the attack was carried out. Subsequent forensics may eventually determine when and how, but may leave unanswered the questions of who or why. More disturbing yet, while most public attention has been focused on the recent exploits of the BlackPOS malware that infiltrated Target’s systems, officials are concerned future malware attacks on Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) may be carried out in a similar fashion so as to trigger a broader, more damaging kinetic event, resulting in the loss of life and property.
While cyber threats continue to proliferate, evolve and grow ever more sophisticated and difficult to detect, one of the most insidious threats to an organization has been and remains the insider. As companies recognize more of their enterprise value in assets defined as intellectual property, the protection of such assets becomes ever more critical – and difficult to monitor.
The Nature of Security Convergence
While many large and mid-size companies typically have the resources and awareness to address converged risks, they are held back by many factors. We would consider such organizations immature in their approach to understanding and managing their converged risk profile. Often, little attention is paid to the concept of converged risk, let alone trying to implement a coordinated approach to converged security surveillance.
Organizations that demonstrate maturity in attempting to understand their enterprise risk profile typically seek to implement solutions, processes and methodologies that also cut across traditional stove-piped hierarchies. Whether they suffer a physical, cyber or insider attack, they may survive due to factors such as organizational resiliency, clear lines of communication among the organization’s risk advocates, protocols for identifying lessons learned, effective training concepts or leadership engagement. In these cases, converged security monitoring and surveillance activities are systemic in nature – they span technology, process and culture – and they thrive under the auspices of engaged leadership.
So how can an organization evolve from an immature converged risk management approach to a mature one? The obvious answer is to take a converged approach. To accomplish this, long-held and sometimes cherished assumptions, opinions, traditions, methods and philosophies must be challenged. Prejudices, inefficiencies and deficiencies must be identified and unsentimentally dispensed with or mitigated, since converged threats will continue to evolve – ever seeking out and exploiting the vulnerabilities present within legacy surveillance systems, software applications and business practices.
In a world where converged and non-traditional risks combine and morph, we are obliged to dispense with the traditional approaches if we are to succeed in protecting our enterprises, no matter how big or how small.
About the Author: Bob Liscouski is CEO and co-founder of Axio Global LLC, an innovative enterprise cyber risk management firm focused on protecting and preserving the value of companies that are essential to our global economy by providing complete cyber risk mitigation and transfer solutions. He is the former Assistant Secretary for Infrastructure Protection for DHS. Max Bobys, VP for Business Development at Axio Global LLC, also contributed to this article.
