Is Cybersecurity a Priority in Your Business?
Total Page:16
File Type:pdf, Size:1020Kb
20 ST. LOUIS BUSINESS JOURNAL TABLE OF EXPERTS IS CYBERSECURITY A PRIORITY IN YOUR BUSINESS? PRESENTED BY Meet the experts SEKHAR PRABHAKAR DAVE HARTLEY ROB MCCORMICK THOMAS HAYDE Sekhar Prabhakar is one of the founders David Hartley is a principal with UHY Rob McCormick founded Avatara in 2005 As a privacy professional at Spencer of C-Edge Software Consultants. Prabhakar LLP in St. Louis delivering “Virtual CIO” with the goal of bringing enterprise level IT Fane, Thomas Hayde aids clients in started his career as a software engineer technology guidance to primarily private solutions to midsized businesses nationwide developing comprehensive strategies to at Arms Inc. working on a subcontract with businesses in the middle market. Hartley through CompleteCloud. CompleteCloud is address information practices and data Booz Allen Hamilton. He was one of the key assists companies with everything from the most secure private cloud environment breach risks, avoid potential claims and members of the supply chain management digital transformation and IT strategy to on the market that leverages virtual desktops liabilities, and ensure compliance with system development team for Continental assessing cyber risks and implementing to help companies centralize data, increase all relevant legal requirements. Hayde Baking Co. (Wonder Bread). Prabhakar then cybersecurity programs. Hartley has performance, and rethink the way they pay also helps clients develop and implement joined Sybase Open Solutions Group and experience in technology, consulting, audit for, access, and support their IT needs. protocols surrounding how to respond supported several Wall Street customers, and C-suite business leadership roles. Prior to forming Avatara, McCormick when a data breach occurs and defends including Merrill Lynch, Goldman Sachs, Prior to joining UHY in 2015, Hartley was chairman and CEO of Savvis clients against potential claims and Shared Medical System and other financial, was vice president and chief information Communications, where he led the company lawsuits regarding data breaches. He has health care and government organizations. officer at Arch Coal Inc., responsible for from its initial IPO (as it evolved from experience defending against and resolving At Sun Microsystems, he was overseeing technology at the company Bridge Information Systems in 2000) to civil claims and enforcement actions under instrumental in maintaining and migrating from 2009 to 2015. He started his career its development and growth as a service specific information privacy laws, such as the Sun Globe System that was used by as a CPA in Big 4 public accounting firms, provider with more than 1 million square FCRA, GLBA, HIPAA and RFPA. senior management to look at sales of the including Ernst & Young, Arthur Andersen feet in data center space, a global network In addition to his privacy and data products across the company. He was also and Protiviti. Hartley’s diverse skillset and and almost $1 billion in annual revenue. security practice, Hayde is a litigator. He part of the quality and financial team, which decades of experience both as a CPA and Additionally, Savvis was honored in 2005 has successfully represented Fortune 50 was responsible for implementing the IRQI a technology executive have made him a with Gartner’s Magic Quadrant Award for and Fortune 250 companies in a wide range (information resources quality index) that sought-after business adviser. Managed Hosting, ahead of companies like of other complex civil litigation matters in was used to govern the Corporate Services IBM and AT&T. state and federal trial and appellate courts. Vision for the entire company. Prior to Savvis, McCormick was COO of Bridge Information Systems. SPONSORED CONTENT 21 Equifax announced a cybersecurity cybersecurity is not just an IT problem; it say is, especially among the smaller somebody else, but it’s not going to breach last month. Last week, is a business imperative. If sensitive data to mid-sized businesses I often am happen to me.” And I think there’s a lot Whole Foods and Sonic announced is not protected, then basically you lose advising that it’s just the culture or the of that thinking still out there. When you cyber breaches. This week, Yahoo your customers’ trust. So, you have to attention isn’t paid as much to this until look at how they got in Yahoo, they did revealed the scope of its breach engage in assessing that risk, and what they suffer a serious or possibly serious a targeted phishing attack on a single was actually 3 billion people, not 1 is the level of security you must attain. incident. Then it hits them that “This is Yahoo employee. The bad guys only billion as previously disclosed. Why By inserting controls, then constantly real” and “It can happen to me, and it have to succeed once where we have to are companies still not addressing monitoring risk, and continuously could potentially disrupt my business to succeed every single time, which is why their cyber risk appropriately? improving upon it, you will minimize a degree of catastrophe.” it’s almost impossible to do. the risk. In the past, companies used to Rob McCormick: The problem you say, “Oh, everything is secure.” So you Dave Hartley: Going back to the original Rob McCormick: People ask, “Why is have in the current age of computing is wouldn’t know unless you’re hacked. question, there’s two things that pop it that all of these hacks are of large people are used to convenient access By following this process, just like how up in my mind. The first thing is, this is companies?” Well, because their to data and oftentimes offline access to you lock your door and check your really difficult work. It’s complex when problem is really hard to solve because data, and there’s a real lack of policies windows, this is basic housekeeping you look at how organizations have they’re distributed enterprises. They preventing them from doing the things that executives have to do, and they grown over decades. They didn’t grow probably acquired the technology over they like to do on the internet. In order should look at it as mostly a business with security in mind. They grew with time, and they can never just start over, to really address these things, you have imperative and not just a technology ease of use, they grew pre-internet, right? If you’re a mid-sized company, to change not just the technology, you problem. and now we’re at a stage where we’re you actually can start over. We tell have to change employee behavior. trying to deal with that. One example people, “The only way to really solve And when those employees are large Thomas Hayde: And in the space of that is Equifax, because if you this problem is start from scratch with performers on the revenue-generation of privacy professionals, there’s this believe the CEO, it was one employee a security-first view of it,” and that’s side, for example, especially in the mid- concept that’s referred to as privacy by who missed one vulnerability, and it technology, employee behavior and business space, employers are really design. And there are some business was combined with the fact that it then the monitoring of that. The larger reluctant to do that. They say, “Well, leaders out there who are trying to was missed by a vulnerability scan. you are, the harder that is to do and its then I have to tell so-and-so to not use incorporate this ideal into their core Look at all the business processes and really expensive. Dropbox,” or I have to say, “You have to mission statement. That you protect technologies Equifax has in place, and it use multifactor authentication to get in,” your consumers’ sensitive information, still happened to them. Same thing with What question should business or “You have to change your password and that the confidentiality, integrity Yahoo. They proclaimed a breach and executives be asking their IT occasionally.” Those are things they and accessibility of that information is said it was a billion accounts affected. leaders? don’t really want to tell their employees protected at the highest possible level. And it was only after Verizon acquired because the employees get aggravated. So every department, every unit, every Yahoo they realized the number was Dave Hartley: Having led a technology We tell people, “You just don’t have a initiative, it starts with what’s called actually 3 billion accounts. Equifax has function at Arch Coal, I would like the choice. You have to deal with it.” The a privacy assessment of how is this hundreds of cybersecurity employees, executives and my clients to ask, “What challenge is cultural not just technical. business initiative going to comply with and it still happened. So, the cyber do you need?” “How can I help?” “What that mission statement? But that’s just response is not necessarily appropriate is it that keeps you awake at night?” I Sekhar Prabhakar: Everything starts not in the cultural zeitgeist of business, or commensurate with the risk right think getting those answers is important with leadership having the buy-in for especially in the U.S.; we do not include now. And cyber risk continues to for you to understand what’s really cyber risks vitally important. Leadership the ideal of privacy by design or security escalate. I think there is a lot of denial has to definitely consider that by design. At a visceral level, all I can in terms of, “It’s going to happen to CONTINUED ON NEXT PAGE R PUSHING THE OUR CONSULTING can mobilize the right people, skills and technologies to help organizations improve their EDGE OF performance.