<\/p>\n
When \u201ceverything is becoming digital,\u201d<\/strong>\u00a0private, public, and civil institutions become more dependent on information systems and more vulnerable to attack by sophisticated cyber criminals, political \u201chacktivists,\u201d nation-states, and even their own employees. As a result, all of our institutions will have to make increasingly thoughtful trade-offs between the value inherent in a hyper connected world and the risk of operational disruption, intellectual property loss, public embarrassment, and fraud that cyber attacks create.<\/p>\n Over the past year, McKinsey and the World Economic Forum undertook joint research to develop a fact-based view of cyber risks, assess their economic and strategic implications, and lay out a path forward. Interviews with executives and data from more than 200 enterprises, technology vendors, and public agencies contributed to the three main findings for enterprises:<\/p>\n The theft of information assets and the intentional disruption of online processes are the most important technology risks that major institutions face. Nearly two-thirds of companies across sectors and regions described the risk of cyber attack as a \u201csignificant issue that could have major strategic implications.\u201d<\/p>\n The defenders are losing ground to the attackers. Nearly 80 percent of technology executives said that they cannot keep up with attackers\u2019 increasing sophistication. Many frontline practitioners said they are seeing the dissemination of sophisticated attack strategies from major nation-states to a broader array of criminals and hacktivists who have much more destructive ambitions.<\/p>\n Large institutions lack the facts and processes to make effective decisions about cyber security. Of the more than 60 institutions whose practices we surveyed in detail, 34 percent had a \u201cnascent\u201d level of maturity and another 60 percent were \u201cdeveloping.\u201d Larger expenditures have not translated into an increased maturity, and many institutions appear to be throwing money at the problem.<\/p>\n Controls required to protect against cyber attacks are already having a negative business impact. For example, security concerns are delaying mobile functionality in enterprises by an average of six months\u2014and are dramatically limiting the extent to which many companies are using public-cloud services. For nearly three-quarters of companies, security controls reduce frontline productivity by slowing employees\u2019 ability to share information. And even though direct cybersecurity spend is small, it can have a much larger indirect-cost impact on the IT organization. Some chief information officers said that security requirements could drive as much as 20 to 30 percent of their overall activity.<\/p>\n There are multiple scenarios for how the cyber security environment could evolve over the next five to seven years. However, if attackers continue to get better more quickly than defenders, this could result in a world where a \u201ccyberbacklash\u201d decelerates digitization. In this scenario, a relatively small number of destructive attacks reduces trust in the economy, causing governments to impose new regulations and institutions to slow down the pace of technology innovation. As a result, the world would capture less of the $10 trillion to $20 trillion available from big data, mobility, and other innovations by 2020\u2014the ultimate impact could be as much as $3 trillion in lost productivity and growth.<\/p>\n Current models for protecting institutions from cyber attacks are becoming less and less effective. They are technology-centric and compliance-driven. They do not effectively involve senior business leaders. They are highly manual and require specialized talent. As a result, they do not scale, given an increasing volume of attacks, and they place too high a burden on the business. All too often security is the choke point for any innovative business initiative.<\/p>\n As a result, not only do practitioners agree they need to build very different cyber security operating models but there is also emerging consensus on what these models need to look like. Here are the key tenets:<\/p>\n While enterprises must upgrade their own capabilities, technology executives said that individual institutions could not be left to fend for themselves. However, there was a high degree of disagreement about the most effective roles for law enforcement, regulators, policy makers, industry associations, and technology vendors.<\/p>\n There is much less consensus on many public issues in cyber security. For example, technology executives were closely split on the value of cyber security regulation. Interestingly, health-care and insurance technologists were most likely to say that even if regulation might be clumsy, it forced top management to devote required time and resources to cyber security. In contrast, a clear majority of banking technologists said regulation has little value: nearly one-fifth of them said current regulations were actively harmful and made their institutions less secure.<\/p>\n Given the trillions of dollars in play, the stakes are high. And given the range of social and business issues that cyber resiliency affects\u2014for example, intellectual property, regulatory compliance, privacy, customer experience, product development, business continuity, legal jurisdiction\u2014it can only be addressed effectively with active engagement from the most senior business and public leaders.<\/p>\n Even improving cyber security capabilities within a single institution requires collaboration across a host of business functions. Operational managers must assess which information assets are most valuable. Privacy and compliance functions have to evaluate the impact of losing customer data. Decisions about how much to monitor employee access to sensitive data have major HR implications. And procurement must negotiate security requirements into vendor contracts.<\/p>\n Given the scale of impact and the degree of coordination and cultural change required, progress toward cyber resilience requires active engagement from the CEO and other senior leaders. They have to make clear they expect the following:<\/p>\n Sustaining the pace of innovation and growth in the global economy will require resiliency in the face of determined cyber attacks. Only CEOs and senior public leaders can solve the problem, because of the strategic and organizational-change issues that need to be resolved.<\/p>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[121],"tags":[],"blocksy_meta":"","yoast_head":"\n\n
A critical social and business issue<\/h3>\n
Making institutions cyberresilient<\/h3>\n
\n
A CEO-level issue<\/h3>\n
\n