SMEs: The Hacker’s Preferred Route into the Corporate World Richard Henson Worcester Business School February 2012

The Reality UK critical infrastructure hacker X X Internet… (600 million Gateways!)

An Early Warning! In April 2009, hackers accessed data concerning technical details of a US govt fighter jet via networks with supply chain partners php php Conclusion: “…there needs to be a new-order requirement on companies doing business with the federal government.”

What can be done about it? Education? Laws? More shiny black boxes? The Cloud? An information security budget? but what is the ROI on data

US govt response.. Other 2009 examples: response to “Night Dragon” establish a “trusted source” program for supply chain partners VP of MacAfee offered a strategy to achieve just that: ecurity-guard-questions-and-answers-with- dennis-omanoff/#sidebar1 ecurity-guard-questions-and-answers-with- dennis-omanoff/#sidebar1

Predictions… Imperva, trends for 2012: trends-for html trends-for html It couldn’t happen here?

UK Government Advice CESG provides guidance and advice: best advice appears to be based on “ISO27001 compliance” On the CPNI website now: guidelines include 20 named technical controls to minimize the chance of a data breach… acknowledge no guidance on physical or behavioural controls Is “compliance” with guidelines, standards, and regulations enough?

Will “compliance” stop this? UK critical infrastructure hacker X X Internet… (600 million Gateways!)

Compliance and Certification Not just playing with words! compliance does not require evidence to back up claims that guidelines, etc. being followed certification only achieved through providing evidence in a systematic way to prove that the guidelines etc. are being adhered to in a systematic way

ISO27001 Certification and SMEs An ISMS has to be the way forward… SMEs not shy of certification. Many already have: ISO9001 – QMS ISO14001 – EMS ISO18001 – H&SMS Logical next step to go for ISO27001?

Research Evidence, Combination of academic research… Coles-Kemp, Barlette et al, and corporate research: Verizon, PWC, PGP, Symantec Conclusions: Main interest in ISO27001 in Pacific Rim (!)

SMEs and Information Assurance Few UK SMEs get ISO27001 certified regarded as too time consuming, too expensive… little ROI… “compliance is the English way” UK (2012) still showing little sign of: bring in new laws… educating about information security so why bother!?!?!

There’s a whole world out there to do business with!

The Global Supply Chain Global companies merely seeking “compliance” from partners taking quite a risk… Pacific Rim supply chain leaders/hubs becoming increasingly ISO27001 (not compliance) focused US getting its act together regarding supply chain hubs/partners via dept of homeland security & focus on cybersecurity

Global Enterprises… which SME would you trade with? Information security not the main factor But what if the other factors are roughly equal? which would you choose? certification (evidence…) or “compliance” (talk…) Real danger that UK SMEs could lose out on contracts on information security grounds… may already be losing out!

Asia (Pacific Rim) Led by Japan, Taiwan… Certification is supply chain driven Impressive take up of ISO27001 certification (approx 80% of world’s ISO27001 certificates)

US has got the message… Latest from Omanoff [VP McAfee] (29/10/11): “… an increase in attacks targeted at industrial systems and embedded devices has raised the risk that manufacturing facilities and other supply chain links could be infected.”

UK SME Priorities for 2012 Omanoff quote used on a UK technology reporting website (v3.co.uk) offers-advice-securing-supply-chains offers-advice-securing-supply-chains Same website: survey for businesses: “main priority for the new year?” 98% reducing costs 1% make more use of social media & cloud 1% improve information security

Not all doom and gloom! What if UK SMEs can be convinced that better information security brings about “reducing costs”? Whole academic field based on such matters: “Economics of Information Security” findings rarely get to SMEs… They should!!!

The Future SMEs will find more stringent requirements on security from global supply chain hubs/leaders Evidence of good information security will be a key factor in getting contracts that means education, and certification… UK government needs to use every means possible to directly support SMEs in helping themselves offering funding top-down to agencies and expecting it to filter to SMEs seems naive