Embracing digitisation means evolving role for cybersecurity

To find out more about how cybersecurity roles are evolving, KPMG spoke to a number of Chief Information Security Officers (CISOs) from major organisations

Organisations across the world have made changes to allow for remote working during the COVID-19 pandemic, but the proliferation of digitisation is creating significant new cyber threats that require radical cultural change at the boardroom level.

Cybersecurity is now a common topic of boardroom debate. In the KPMG 2021 CEO Outlook Pulse Survey, cyber risk was ranked as the number one organisational threat by global CEOs, with data security taking a priority over all other technology investments. 

A new report from KPMG ‘From enforcer to influencer: Shaping tomorrow’s security team’ is calling on business leaders to ensure cyber security specialists are part of the C-suite decision making process, with digitisation at the heart of their future growth strategies.


Helping address cybersecurity issues

The report offers seven key recommendations to IT leaders and Chief Information Security Officers (CISOs):


  1. Speak the language of the board by thinking in terms of customers, revenue, costs and return on investment.
  2.  Focus on operational resilience: keeping the lights on and getting back to normal quickly following a crisis. 
  3. Invest time in building a network within your organisation, visiting different functions, learning how they operate and gaining trust that you want to enable — safely — and not just say ‘no’. 
  4. Think about shaping a workforce to the cyber needs of the business — as opposed to permanent roles and structures. 
  5. Consider the ratio of employees to contractors and gig workers. Build a business case for automation, reflecting the efficiencies it brings and the value added from workers who are freed up for higher-level tasks.
  6. Work out what zero trust means for your business and see this as an ongoing philosophy rather than a one-off programme. 
  7. Find ways to reach out to peers in your sector, either joining existing industry bodies or forming less-formal groups.


Creating trust and delivering security 


Fred Rica, Principal, Cyber Services, KPMG in the US, said: “Organisations have made incredible strides in remote working and collaboration for employees, as well as improving digital customer experience. But this has also reminded us that physical perimeters no longer exist. With increasing reliance on third parties, and the proliferation of Internet of Things (IoT) and other devices, cyber security now involves complex ecosystems with a dramatically increased threat potential.

“In a marketplace where speed to market is essential, cybersecurity teams are now responsible for building trust and resilience, by forging a pragmatic security culture and helping embed secure by design thinking into every aspect of digital infrastructure and data. To do this, they must see themselves as enablers and facilitators, helping others deliver services and brands that deserve cyber trust amongst customers, employees and society at large.”

As CISOs move forward and address the ever-evolving cyber threat landscape, they must balance many responsibilities, formally and informally. This means shifting from enforcer to influencer, fostering security awareness, and building vital relationships with peers. 



Featured Articles

Gartner unveils top cybersecurity predictions for 2023-2024

Half of CISOs will formally adopt human-centric design practices into their cybersecurity programmes, while adoption of zero trust architecture will rise

DDoS protection market to grow amid increase in attacks

According to research by Cloudflare, DDoS attacks increased by 109% last year, with the last 12 months seeing some of the largest attacks the world

The impact data poisoning has on cyber and AI

We take a look at why the risks of data and AI poisoning is continuing to wreak havoc on the cybersecurity industry

Five innovative ways AI can help prevent cyber attacks

Cyber Security

SailPoint delivers new non-employee risk management solution

Cyber Security

Akamai shares details of Asia’s record-breaking DDoS attack

Network Security