French security chiefs agree united effort needed to meet cyber threat

The study found out that, although top executives claim that prevention of cyber risks and human mistakes in the IT area are a priority for their companies, not enough has been done to make sure that an attack against them will not be successful. The findings concur with a recent survey carried out by insurer ACE on IT and cyber risks that identified French and German companies as the least prepared for this category of risk (see story below). The survey, commissioned by Club des Directeurs de Sécurité des Entreprises, CDSE, an association of security chiefs, also disclosed that 84% of the companies surveyed have already been victims of data theft, while 88% have identified viral attacks against their systems.hideThe results were presented during the annual conference of heads of security that took place in early December in Paris and was attended by Commercial Risk Europe. Cyber threats were the main theme of the day-long conference, during which participants discussed the level of preparedness of French companies to mitigate such risks as well as the evolving character of the threats that they must put up with. "The challenges, as well as the stakes, are enormous, and the solutions are yet to be discovered," said Alain Juillet, Chairman, CDSE, during his opening speech. According to the survey of heads of security in over 130 companies, four out of every five boards in the country are aware of the severity of the risks presented by the use of information technology. But the security bosses of 87% of the companies that took part in the survey also said that their firms have not taken all the steps required to properly protect their IT systems. The delay is a concern especially because the nature of the threats they face changes all the time. The emergence of cloud computing, social media and initiatives such as Bring Your Own Device (BYOD) programmes create ever new risks. Bruno Gruselle, a researcher from Fondation pour la Recherche Stratégique, who authored the study, noted that a combined effort is required if companies really want to protect themselves from IT threats. "Cyber risks are not linked only to the IT department, but to all parts of the company," Mr Gruselle said. "Therefore a joint effort is required to fight them." At the same time, IT security budgets are limited. This means the people responsible for the management of the risk need to make choices that could soon prove outdated. Simply lavishing money on security IT systems is not going to do the trick, said Nicolas Ruff, an IT security expert at EADS, the aerospace and defence group. He said that hackers will always come out with a way to dodge software-based security systems, no matter how expensive they are. "All the products that you buy, the pirates will buy too, and they will find a way to beat them," he said. New threats emerge all the time. Some 80% of the attacks faced by companies use tools that are easily available on the internet, Mr Gruselle pointed out. Patrick Pailloux, head of Anssi, the French IT security agency, told the audience that a software package that can be used to spy on texts and other data stored in an iPhone can be acquired for free on the web. A ‘professional’ version, which enables hackers to listen to conversations from the phones interfered with costs little more than €60. The audience was also treated to a demonstration by the French Home Ministry which used software to download all the data from an iPhone in merely 40 minutes. By demonstrating how easily company information that is stored in personal smartphones can be stolen, the example highlighted the risks of BYOD policies. Such easily available tools mean that anyone can become a hacker today. But a smaller number of highly sophisticated attackers also prey on companies and use tools and methods that are difficult to identify even for better-prepared entities. Jean-Paul Bonnet, the head of security at BNP Paribas, said that phishing attacks presented a worrying evolution in 2012. He also remarked that a recent reproduction of the bank's webpage that his team has spotted ‘was not the work of amateurs’. But companies often fail to implement simple solutions, such as the employment of experts to work on the detection of sophisticated attacks that will not be automatically detected by often inadequate software-based tools, Mr Ruff said. The human factor was also highlighted by Mr Gruselle. The survey found out that 63% of the companies interviewed are concerned about the risk that employees can cause damage by the misuse of technologies. Companies would benefit from sharing their experiences to help face such threats. But this is simply not happening today, according to Philip Duluc, Head of Security at Bull. "Companies are not willing to talk about the attacks that they face, which makes it more difficult to develop tools to fight cyber threats," he said.

French security chiefs agree united effort needed to meet cyber threat

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Want to read this article?

Read Next

Ferma members told AI will bring risk and reward for corporate insurance buyers

Aon’s revenues up 5% as it completes $13bn NFP deal

Warmer climate spreading risk of malaria and dengue to new regions

UN launches new net-zero insurance forum to replace NZIA

Pen extends fleet capacity deal with Zurich in Republic of Ireland

Related Articles