The Case for a Global Cybersecurity Strategy

November 24, 2014

Rod Beckstrom

Former CEO of ICANN & US National Cyber Security Center

There’s little question that top management at leading business and government organizations now understand the need to invest in IT security.

Whether it’s the noted credit card breaches at retailers such as Home Depot and Target, or the malware attack on 30,000 computers in 2012 at the Saudi oil giant Aramco, most everyone in business and government recognizes the threat landscape today is much more dangerous.

With something close to 100,000 strains of malware introduced every day, it’s also clear that business and government can’t solve the cybersecurity threat alone. That’s why the World Economic Forum developed a project in conjunction with more than 100 business and government organizations to identify and address the risks that have emerged as organizations grow more dependent on data networks and Internet connectivity.

Some Guiding Principles

As part of its published report, “Partnership for Cyber Resilience,” the World Economic Forum identifies four guiding principles for how business and government organizations can respond to the emerging threat and build cybersecurity awareness into the very fabric of their organizations.

1. Recognize the interdependent nature of the hyperconnected world and the organization’s role in contributing to a safe, shared digital environment.

   Organizations are only as strong as the weakest link in the chains on which everyone depends. To that end, all organizations must contribute to the safety of the hyperconnected world. The public derives significant benefits from an open, secure and resilient online environment, so all parties share responsibility for creating and supporting global networks.

2. The executive management team sets the tone and structure for cybersecurity awareness.

   Along with fiduciary and other leadership duties, top management also must recognize the important nature of mitigating cyber-related risks as an essential element to the ongoing viability and success of their organization. Only through aggressive cybersecurity can an organization safeguard its intellectual property and protect its sensitive information so it can freely deliver products or services to its customers or constituent bases.

3. Recognize the importance of integrating cyber risk management within broader risk practices.

   Consistent with best practices in the field it operates, an organization should develop a specific program geared towards managing cybersecurity risks on a continuous basis. In doing so, the organization reduces the risk of harm to itself and contributes positively to the connected information environment and demonstrates good corporate citizenship.

4. Encourage suppliers to adopt these principles and guidelines.

In recognizing that the widespread adoption of these principles contributes to the enhanced opportunity for all stakeholders to benefit from high levels of online connectivity, an organization should encourage others to adopt these principles. Broader adoption by third parties more effectively secures the supply chain and benefits everyone involved.

Act Locally, Think Globally

The World Economic Forum’s initiative takes an “act locally, think globally” approach. It challenges each organization to focus on its own cybersecurity and in doing so, improve the online environment for the general public at large.

The World Economic Forum wants companies to strive for what it calls a “networked” Stage 5 organization, in which companies are highly connected to their peers and business partners, sharing information and jointly mitigating cyber risks as part of daily operations. In these organizations, staffers show exceptional awareness of cybersecurity issues and operate as leaders within their respective industries.

Of course, achieving this high level requires top management to make cybersecurity a priority, communicate that to the organization’s various departments, then form teams that can do the work that needs to be done to ensure cybersecurity becomes a part of everyday life. While deployment specifics will vary by organization, this set of common principles offers business and government a way to get organized and move forward as the world, together, takes on increasingly dangerous threats.