SPeCIal aDverTISIng SeCTIon
Cybersecurity
Roundtable Photography by ROB HARDIN
Threats facing businesses right now
How executives should prepare
What’s next?
March 2020 l ColumbusCEO
59
I
Special Advertising Section
t seems almost commonplace to read news stories about companies and governmental bodies suffering from a data breach or getting hacked for ransom. As more commerce and information moves online, cybersecurity gains a growing importance for executives leading enterprises of any size. Columbus CEO discussed key issues involving cybersecurity with representatives from Affiliated Resource Group, Blue & Co., Grange Insurance and Horizon Telecom, which hosted the roundtable at its Columbus offices on Jan. 16. Here is an edited and condensed version of that conversation. Transcript provided by PRI Court Reporting.
Ray Paprocki (Columbus CEO): What are the most common cybersecurity threats that businesses need to be aware of today?
Timothy Cunningham (Grange):
From my experience at Grange most recently, phishing seems to be the highest threat. It’s characterized by low effort and high value and usually to take advantage of gaining credentials for monetary gain. That’s followed by the introduction of malware. Third would be the misconfiguration of cloud assets. So protecting assets in the cloud, which in many cases is new to a variety of organizations.
And then, finally, I think a low risk that is sometimes unnoticed and not frequently reported is vulnerabilities in third-party service providers, where the standards and controls and risk practices that you have internally you assume that your third-party service provider is operating at least at that level, but you oftentimes find that they’re not for a number of reasons.
Tom Skoog (Blue & Co.): I think one
of the other threats that companies are really starting to face now is as the Internet of Things really starts to explode, it takes your network from, let’s call it, three or four access points from the outside and makes three or four thousand access points from the outside. We see this a lot in health care, with medical devices getting put on the network, and they are notoriously full of bugs, security bugs.
Craig Drinkhall (Horizon Telecom):
Another thing we haven’t talked about is things that are sometimes as troublesome but maybe not as direct, something like a denial of service, where they’re not actually stealing something or getting bad info, but through that mischief you can take all the systems offline by creating problems, which is
“Security has got to become part of your DNA.” Michael Moran, Affiliated
just as good as them not being there. So that becomes a big problem, too.
CEO: What are some of the fundamental things that businesses should be thinking about on these topics?
Michael Moran (Affiliated Resource): In smaller companies, the
executives are focused on driving the business and doing what they do because everybody has to wear multiple hats. Not that you don’t necessarily have to do that in a larger company. But the challenge really is to get the executives to pause and really think about what’s important to them, get them to do that governance step of what’s important to us, what are we trying to protect. And then once you’re doing it, what are the threats to the business? It’s getting them to think about that so that you can start looking at it and then getting something like a threat assessment, understanding where are we. Because if you don’t really know, you can’t do it. The idea of user awareness—usersecurity awareness training—is so important. And I can’t tell you how many people just look at you kind of like, yeah, we did that once a year. That’s not going to do anything. Security has got to become part of your DNA. And I think it starts with the leaders really thinking about that.
Skoog (Blue & Co.): If they got
Resource Group
P a r t i c i p a n t s
Tom Skoog Principal and IT risk and advisory practice leader, Blue & Co.
60 ColumbusCEO l March 2020
Craig Drinkhall Director of products and sales engineering, Horizon Telecom
Glenn Lytle Chief revenue officer, Horizon Telecom
Timothy Cunningham Chief information officer, Grange Insurance
Michael Moran Co-founder and president, Affiliated Resource Group
Special Advertising Section
religion about patching, if they got religion about things like using stronger passwords, that doesn’t cost anything. Patching doesn’t cost anything. Then testing the effectiveness of that training through internal phishing campaigns that you can launch against your own company and see who needs extra training because they continually are the ones that are clicking on an email that they shouldn’t have clicked on.
Drinkhall (Horizon Telecom): I would say one generic description would be to always think of security as one of the first things that you do. We hear that all the time. But many times it’s not done. When you say I’m going to build this new application or I’ve got these new devices, it’s going to make our business—our core business—run a lot better, and you get so enamored with that that you don’t start to think about security until maybe a bad incident happens or maybe later in the game. If you can build that security and think of it up front, usually it’s less expensive to do, and it probably avoids a lot more problems.
Cunningham (Grange): When you think about, it’s more likely a matter of when you get compromised in some fashion, not if. So then how have you protected or limited your blast zone of exposure? Once you get in the front door, does it give you access to traverse through the whole network? You segment things and you partition it off. You then have to make sure that you limit the damage control area, and that’s really important. You want to be a little bit stronger than the competitor, ideally. You don’t have to be the fastest runner in the woods when the bear is after you; you just don’t want to be the slowest. Because the easy targets are going to be taken advantage of. CEO: How do you get executives on board because so much is at risk?
Moran (Affiliated Resource): There were two senior partners in CPA firms, and we were talking about this, and I
Affiliated Resource Group is a technology advisory firm that provides cybersecurity compliance and IT support services for small- and mid-market companies. Aresgrp.com Blue & Co. is a regional accounting firm with 10 offices in Ohio, Indiana and Kentucky that focuses on health care, manufacturing, construction and nonprofits, as well as offering audit, tax, financial consulting and IT risk and security services. Blueandco.com Grange Insurance is a regional insurance company based in Columbus that offers auto, home, life and business products to customers in 13 states. Grangeinsurance.com Horizon Telecom is a fiberbased broadband carrier based in Chillicothe (with a Columbus office) that serves seven states. Horizonconnects.com
March 2020 l ColumbusCEO
61
Special Advertising Section
they start paying attention.
Glenn Lytle (Horizon Telecom):
I would even add that the total cost of ownership goes beyond the lost revenue. I think that there’s a long-term impact when you look at the brand and what’s associated with what just happened.
asked, what’s it going to cost if you had a data breach at your organizations and you were attacked with ransomware? And both of them just shuddered and said, it’s going to be ridiculously expensive. I said, well, how do you feel about your preparations as an organization and where you are today? They said, we both recognize that we’re not where we need to be. I said, why is that? They both said, until you have an incident, you don’t know exactly how much you should be spending or what you should be doing until you get it. It really was an issue of awareness.
Part of it is helping them sit down in a room and recognize what their value is. We’ve done this for years—helped people with a disaster recovery planning process where you go through and you ask them what’s important, what’s of value to the business. When you sit there and have that conversation with an executive and then you talk about the results from different surveys and things that say the average organization could be down for three days or longer, a small business, when they get hit with ransomware, you’re looking at real dollars, and then
Moran (Affiliated Resource): So you’re a professional services firm and you can’t file a claim or you can’t file a motion for your most important client. What does that cost you? Because in a legal field everything is done electronically today. You’re an engineering firm and you can’t turn in an RFP electronically that’s worth a half million or more dollars. You’re a medical practice and
“If you can build that security and think of it up front, usually it’s less expensive to do.” Craig Drinkhall, Horizon Telecom
3 Critical Questions Every Company Executive Should Ask About Your IT Systems…Today Are our IT systems at risk of a cyber-attack, natural disaster, or meltdown? What is the cost to our organization if our IT systems were shut down for even a day? Do we have an IT recovery/response plan in place to protect the organization?
No Obligation IT Risk Review & Action Plan Our Risk Review includes a review of your systems, network, and servers, backups, a validation of your on-premise and cloud security approach, response preparedness, and operational efficiency factors. We will then present an action plan help you meet your desired business outcomes.
CALL JASON AT 614-495-9658 TO START YOUR FREE IT RISK REVIEW & ACTION PLAN
62 ColumbusCEO l March 2020
Special Advertising Section
you can’t see patients for one, two or three days, what happens?
Skoog (Blue & Co.): We’ve had three
of our clients that have been impacted by ransomware. One of them was fairly public in the press. And they paid right away. But as I visit with CIOs at critical access hospitals or community hospitals, I’m still astonished at the lack of effort and the lack of focus that cybersecurity is getting in hospitals. The HIPAA rules are very strict on how there are 34 or so specific things that hospitals need to do. And we ask about things like training in internal phishing, which is very affordable, you know, a couple thousand bucks a year to get a license to do that. I asked one CIO about doing that, and he said, our management said we just can’t afford that.
Cunningham (Grange): They can’t
afford not to do it.
Skoog (Blue & Co.): I’m kind of
surprised at how many companies are still thinking that, well, this just isn’t going to happen to me, even though
hospitals received 90 percent of the ransomware attacks in the United States in 2017.
Lytle (Horizon Telecom): I think it’s
really how you position it. It’s really not going upstream and saying, what if the event happens? It’s more when the event happens. Because I think they say it’s not going to happen to me. My answer to that is always: Hope is not a strategy. If you approach it as we need to be prepared for when we have this type of an event, you’re a lot more prepared.
Cunningham (Grange): We do exercises at the executive level to say let’s run through our crisis-management plan because you have to communicate to your customers and future customers of how you handle that situation. And we’ve seen all the examples— there’s a litany of them—where that has gone poorly in the lack of timely communication and lack of timely notification. Then the aspect of the regulatory landscape continues to change, the new laws that are trickling down to all sizes
of industries. It’s the essence of your personal identity and, in the digital age, how important that is to that individual to protect it for their lifetime. Regardless of the service provider, they have the same responsibility to protect that to the highest level that you’d want to protect it for yourself. Anyone that’s not doing that, I think is going to be self-selected out. They’re not going to be able to be compliant and they will go out of business.
Drinkhall (Horizon Telecom): Especially with an incident. There’s some kind of large percentage of people after a certain number of days who actually don’t recover and the business can just fold. CEO: So a lot of things have been addressed, but then we’ve always got to prepare for what’s coming next. So what’s coming next?
Cunningham (Grange): The pace at which attacks are occurring is just con-
March 2020 l ColumbusCEO
63
Special Advertising Section
tinuing to increase. It’s less brute force and more the use of sophisticated tools and analytics. It’s kind of like an arms race. And thinking that you can win the battle just by throwing people at it is not likely going to be a long-term successful strategy. I do think that we’re at a point where we’ll have to continue to invest in preventative controls. The greatest vulnerability continues to be human oversight or mistakes. So even though you may have gotten everything configured right, if someone makes a bad decision, you have to have your other aspects to limit the blast zone, recover from it, get out there and prepare for how you would respond and make sure that you’re in a good position. But it’s going to continue to be a threat profile that gets more complex, more sophisticated versus easier.
Moran (Affiliated Resource): The
emails, the phishing is going to become significantly more personalized and more risky. I think that—once they get in—they’re potentially in your systems for months. People are going to start dropping bombs where they’re
Drinkhall (Horizon Telecom): I think the one thing that worries us, something that we’re going to be seeing in the future, is that people are moving more things to the internet. That’s accelerating. The internet is becoming the more risky place to do business. And two things really accelerating are 5G technology and then this Internet of Things is going to explode. And those two kind of vulnerable areas . . . again, going back to being enamored with the business benefit. I can make all this work. Isn’t this great. But if you haven’t built that security it’s just going to multiply. Instead of like three or four places you’re worrying about, it could be thousands of places. So we’ll see that happen in those two technologies.
doing things today. You clean it up, but you don’t necessarily clean it all up, and it’s there again and again.
Skoog (Blue & Co.): I think in the
future the middle market and below are going to become even more of a target. Because above that Mendoza line they’re able to invest more in preventative measures and detection mechanisms. The bad guys are going to realize there’s easier fish to catch so let’s start focusing. There may not be as many assets to monetize, but we can hit 10 companies in the same amount of time it takes us to try and hit this one company, and it’s going to be a lot easier and we’re going to be successful 10 times. I think in the future, medium and small businesses have got to frankly wake up and realize, one, they have assets that are monetizable, they are targets of these guys. If they don’t have assets that are monetizable, then their business itself is, through a ransomware attack. And they have to start doing a number of the same things that bigger companies are doing to thwart these attacks. I think it’s a continual chess match.
CEO: Is there anything that we haven’t covered that you’d like to add?
Drinkhall (Horizon Telecom): Mission accomplished if we convinced the business owner to be more aware.
ONE WORM RUINS THE APPLE ARE YOU PROTECTING YOUR DIGITAL HEALTH? Just one cyber attack can have a massive impact on your business, bank account, credit ... the list goes on. Grange Insurance provides resources to help you understand cyber security, establish safeguards against breaches and build an effective data breach response plan should that one worm make it through. Protect your business. grangeinsurance.com/cyber Products not available in all states.
64 ColumbusCEO l March 2020
+ AUTO
+ HOME
+ LIFE
BUSINESS