VIEWPOINT

2024

B I G DATA? B I G S E C U R I T Y !
How to protect your data from theincreasing risk of cyber threats

The revolution introduced by the digitization

AUTHORS

process has made it possible to generate and collectincreasingly expanding volumes of data. As a result,

Mario Nico

public and private organizations must define new

Michael Kolk

strategies, design and implement protection systems,
adapt their operational models, and learn to manage

Dario Garante

information by mitigating the risks linked to cyber

Riccardo Calogiuri

threats — while remaining in compliance with theLorenzo Cimarelli

provisions of the main regulations in force. In thisViewpoint, we describe the measures organizations
must take to mitigate risks.

ARTHUR D. LITTLE

VIEWPOINT

MORE DATA , MORE AT TACKS!
Data is a fundamental business asset. Itsloss or compromise can significantly harmcompanies and organizations in terms ofC Y B E R AT TA C K S H AV E
INTENSIFIED SINCE END
OF THE FIRS T QUARTER
OF 2023

financial performance, brand reputation, or lossof customers. Whether an organization leverages
data to run its business, or data is a byproduct

Nevertheless, as data increases exponentially,of conducting day-to-day operations, or thethere has been a continuous growth of

institution sells data assets as a one-off product,

cyberattacks (although a direct correlation has

all data must be managed, protected, tracked,

not been proven). Infosecurity Magazine reports

and updated. The economic value of data isthat cyberattacks against government agencies

further amplified as enterprises go throughand public sector services increased by andigital transformation, leading to increased

astounding 40% in the second quarter of 2023

data production.

over the first quarter. BlackBerry Cybersecurity

Organizations have not yet grasped all aspects

claims it stopped 1.5 million attacks over the 90

concerning data, including these importantdays from March to May 2023, of which 55,000

considerations:targeted the public sector. Analysis of data shows- Who can access the data, and what data

the first quarter of 2023. According to BlackBerry,

can they see?

-that cyberattacks have intensified since end of
the highest distribution of cyberattacks during

How can data be protected from illicit

that period included:

access attempts?

In the Viewpoint “The Cyber Battlefield,”- Financial institutions- Healthcare services and equipment- Government/public entities- Critical infrastructure

Arthur D. Little (ADL) shared several strategies

Further analysis of the types of attack reveals

for companies to establish cybersecurity

the reasons behind a cyberattack fall into twocapabilities. While most data security breaches

categories:- How competent are users, and how do you
ensure they continue to be informed aboutrisks associated with processing of information?

(74%, according to Verizon) are generated
by internal user error, employing IT systems
such as privileged access management allows
organizations to govern user access to information,
limiting the risk of unauthorized access. At thesame time, it is possible to adopt solutions (e.g.,security information and event management) tocontrol who accesses what and monitor how data ischanged. Such IT systems enable organizations todetect abnormal behaviors that can be traced back1. Economic. Perpetrated by criminalorganizations, these attacks take advantageof a variety of available tools (e.g., ransomware,
distributed denial-of-service [DDoS], malware,phishing) to return a profit. As an example,
consider the case of the UK’s Royal Mail, which,following a ransomware attack in January2023, refused to pay the £67 million (aboutUS $85 million) the perpetrators demanded.

to malicious access attempts, allowing timelyintervention. Investments like these enableorganizations to respond proactively to therisks generated by cyberattacks.

BIG DATA? BIG SECURITY!

2ARTHUR D. LITTLE

VIEWPOINT

2. Political. These attacks are, at their base,related to political issues (sometimes local
but more often international). They can often
be traced to acts of activism but may also

According to DemandSage, an average of 328.77

be used to foment cyber wars and can be

million terabytes of data is created every day. But

compared to acts of terrorism. For example,

the ability to ensure the proper management andin November 2023, Russian hackers breachedprotection of data remains elusive. While from a

22 Danish power companies in the context ofsecurity and privacy perspective the EU Generaltensions between the Russian Federation andData Protection Regulations (GDPR) has raised

the NATO blockade.

a shield to defend information, the regulation ofConsidering the high costs of data breaches
in terms of money (IBM estimates the average
cost of a data breach in 2023 to be US $4.45
million), time, and reputation, the importanceof preventing attacks is abundantly clear. For
this reason, organizations must:-Understand the regulatory landscape —to unlock the value of data; protect data fromunauthorized access, disclosure, alteration,or destruction; and maintain the privacy of
individuals and organizations-REGUL ATORY L ANDSCAPE
TR ANSFORMATION

Commit to increasing investments indefensive technological solutions — withthe goal of better understanding competition,customers, and technological trends;
supporting business growth; and ensuring
secure management of information- Adopt standards and frameworks andbig data use still awaits final approval of the EU
Data Act, which is joined by the AI Act (legislation
focused on regulating data analysis processes
based on artificial intelligence [AI] technology).
Both legislative acts face a path of about 12
months (end of 2024) awaiting definitive approvalby the EU. Thereafter will begin the process inwhich the acts are transposed into national law
by EU countries.
Although GDPR’s reach extends only to personaldata, the Data Act encompasses both personaland nonpersonal data, making its range ofapplication notably wider. The Data Act aims toeliminate data-access hurdles for both public
and private organizations, making it simpler
to transfer data among service providers andencouraging a broader range of participants,
including small and medium-sized enterprises,
to engage in the data economy. These new

define business practices — to guarantee

regulations will empower consumers anda qualitative and quantitative level ofbusinesses to have a voice in determining theinformation security, continuously adapting tousage of data produced by their connected

the growing number of attacks and balancing

devices.

data sharing with protection (see the ADL
Viewpoint “Harnessing External Data Sharing
to Unlock Transformative Collaboration”).

BIG DATA? BIG SECURITY!

3

ARTHUR D. LITTLE

VIEWPOINT

Additionally, with increasing integration of AI
systems into everyday life, issues surrounding
data protection and ethical considerations have

COMMITMENT
TO INVES TMENT S

come to the forefront. Cybercriminals could use

The growth in data availability is leading

AI to easily develop malware that can discovercompanies, both public and private, to make everpreviously unknown vulnerabilities or evadegreater investments in the acquisition of tools

detection and create sophisticated phishingand technologies for their management. The aim

attacks. GDPR supports the creation of AI and big

is to know about the competition, customers,

data applications that effectively strike a balance

and innovative technological trends and tools; tobetween data protection and other societal andsupport business growth through the planningeconomic interests yet offers limited guidance

and implementation of effective strategies; andon accomplishing this objective. Consequently,

to ensure the secure management of information.

the AI Act aims to regulate AI through a riskbased approach, which differentiates complianceobligations based on the potential risk that
intelligent software and applications may poseto fundamental rights. The higher the risk, themore substantial the compliance requirements
and responsibilities for the creators of smart
applications.

But while investments have focused on theacquisition of know-how for the analysis,processing, and visualization of informationand technological tools like business intelligence,
data analytics, and AI systems, a report publishedby the European Union Agency for Cybersecurity(ENISA) highlights numbers linked to the main
growth drivers of information security spending

The completion of the regulatory path for bothin 2023. The report identifies the main drivers of

the Data and AI Acts by EU countries will require

the increase as hybrid working, transition frompublic and private organizations to adapt within

virtual private networks (VPNs) to zero-trust

certain time frames and change processes,

network access, and the move to cloud-based

committing new budgets and adapting businessdeployment models. The study estimates anmodels to ensure compliance.

overall growth in spending in 2023 of $143 billion,
and the estimate for 2024 stands at $163 billion,
with a growth of up to 14% (see Figure 1).

Figure 1. Information security spending per region, 2023–2026
Figure 1. Information security spending per region, 2023–2026+10%+12%in US $ billions+14%14315183

19920191634817443833952023

1201082024
North America

2025EU1312026

Asia–PacificSource: Arthur D. Little, ENISABIG DATA? BIG SECURITY!

Source: Arthur D. Little, ENISA

4ARTHUR D. LITTLE

VIEWPOINTG R O W T H I N D ATA
AVA I L A B I L I T Y I S
L E A D I N G C O M PA N I E S
T O M A K E E V E R G R E AT E R
INVESTMENTS IN THE
ACQUISITION OF TOOL SAND TECHNOLOGIESFOR THEIR MANAGEMENTAccording to the ENISA report, the largest
increases in spending in 2024 concern cloudsecurity (+24% year-over-year [YoY]), in
accordance with the substantial and generalmigration process from proprietary on-premisesarchitectures to cloud solutions, and data
privacy (+24% YoY), as the organizational focus
remains the processing of data for privacy
purposes (see Figure 2).
The factors behind these numbers are linked
to the growing risk of cyber threats as well as

The report predicts sustainable growth through2026, with double-digit percentages every year.
By geographical area, North America represents,
on average, two-thirds of annual global spending.
The gap between North America and other areas
highlights a greater focus on security issues inthis region and emphasizes the need for otherareas to increase investments to bridge thetechnological and cultural gap.

the changes affecting organizations and theiroperating models in the process of adapting to
the new business paradigm, which acknowledges
data as a fundamental asset for companies, bothpublic and private. This value makes the level ofsecurity implemented and perceived increasingly
critical: first, to guarantee regulatory complianceand secure the value that the company will beable to generate from access to information,and second, as an element that is of concern
to stakeholders and shareholders.

Figure 2. Growth in worldwide end-user spending in security and risk,
2023–2024
Figure 2. Growth in worldwide end-user spending in security and risk, 2023–2024

Network
securityequipment

Consumersecurity
softwareIntegrated
risk
management

Security
services

10%

10%

13%

Data
privacy

Cloudsecurity

Other
information
security
software

24%

24%

24%

Data
Identity Infrastructure security
protectionaccess
Application
security management
19%
18%
15%15%

5%

Source: Arthur D. Little, ENISA

Source: Arthur D. Little, ENISABIG DATA? BIG SECURITY!

25

VIEWPOINT

BIG DATA? BIG SECURITY!

ARTHUR D. LITTLE

6

ARTHUR D. LITTLE

VIEWPOINTAPPLYING PROPERFR AME WORKS &BUSINES S PR AC TICES

Adopting a standard framework allows
organizations to achieve a series of benefits,
including:- Information security awareness — enabling

A structured framework is crucial for effective
information security management. In considering
information security and personally identifiable

the implementation of robust measures for
safeguarding sensitive information- Risk mitigation — gaining a deeper

information (PII) protection, organizations canunderstanding of risk management andrefer to widely recognized standards such asproviding the ability to identify vulnerabilities,

ISO/IEC 27001:2022 or the NIST Cybersecurity

assess risks, and implement strategies toFramework (CSF). These standards offer

mitigate themstructured frameworks and best practices- Regulatory compliance — complying withfor evaluating and mitigating information
security risks. The adoption of an organizational

relevant laws and evolving regulations,framework can enhance time to market byproviding a proactive approach to maintaining

standardizing processes, automating security

information security- Enhanced reputation — increasing an

and privacy compliance, and establishingconsistent measures.

organization’s reputation and providing

Table 1 highlights the main characteristics ofgreater confidence of an organization’s

the two frameworks, but it is important to specify

customers and partners, fostering betterthat these frameworks often cover the same

relationships and creating additional businessareas, such as identifying risks, implementing

opportunities- Cost savings — following the initial

controls to reduce risks, and monitoring
performance. An organization can integrate theinvestment, prompting medium/long-term

frameworks synergistically to create a holistic

benefits due to increasing information

approach to cybersecurity.

security “culture,” decreased likelihood of
breaches, and subsequent reduction in legal

Table 1. Approaches of different frameworks

fees and reputational damage

Table 1. Approaches of different frameworks

ISO/IEC 27001:2022

NIST CYBERSECURITY FRAMEWORK 2.0

Focus

Improving an organization’s information
security management system

Managing & reducing cybersecurity risks
to networks/data

Brief description

Provides systematic approach to managing
sensitive company information, including
data management, access controls & risk
management

Provides a framework that any organization can
use to elevate the maturity of its cybersecurity
risk programs

Number ofrequirements

93 controls divided between 4 themes:
1. People (8 controls)
2. Organizational (37 controls)
3. Technological (34 controls)
4. Physical (14 controls)

6 functions to customize cybersecurity controls:
1. Identify
2. Protect
3. Detect
4. Respond
5. Recover
6. Govern

Expected cost

Involves series of audits & certifications
that involve greater expense

Voluntary, allows organizations to implement
the standard using preferred pace & resources

Source: Arthur D. Little, OneTrust

BIG DATA? BIG SECURITY!

7

ARTHUR D. LITTLE

VIEWPOINT

In general, the ISO/IEC 27001:2022 standard is

By aligning with these well-establisheduseful for operationally mature organizations

standards, organizations can methodicallythat aim to put in place or improve their entireidentify and address potential threats,

information security management cycle and aresafeguarding both information security andseeking certification to demonstrate the company’s

privacy, while demonstrating their commitment

dedication to security and compliance. Conversely,

to compliance and data protection. It is important

the NIST CSF is more suited to evaluating maturity

to remember that there is no one-size-fits-allin the first stages of developing a cybersecurity risk

approach, so every organization must choose themanagement plan or in attempts to mitigate priormodel that best suits its needs.

failures or data breaches.

Case study: Protecting water resources in Italy
A project in Italy sought to enhance theinformation assets of the surveillance system
for territory governance and the protection ofwater resources. Its primary objective was todefend water sources from anthropogenic andnatural threats through an integrated monitoring
network to assess the status of water resources
and soil.
ADL designed a system to monitor the quality,
availability, and safety of water by allowing- Internet of Things (IoT) sensors- Remote sensing through optical and radar
images acquired by the Sentinel-1 (radar)and Sentinel-2 (optical) constellations of
the European Space Agency (ESA) Copernicus
program- Video surveillance- Web application for viewing geospatial
data and monitoring dashboards

authorities — on the basis of their responsibilities

The system included a segregated network,and competences — to take the measuresprotected by a multifactor authenticationnecessary for mitigating criticalities and risks,

firewall, externally accessible only via VPNs andpromoting appropriate prevention actions.

with firewalls installed on individual servers. The

The project’s complexity centered around thearchitecture was designed to manage information

management of a critical amount of vital data.

in compliance with ISO/IEC 27001:2022 standards

In addition, the information management system

to ensure maximum security of strategic

needed to ensure that the data could support

information, while internal processes werevarious authorities’ investigations, particularly

formulated to define the correct collectionin the detection of environmental crimes and inand maintenance of information in complianceallowing for those investigations to be carried outwith GDPR. To this purpose, ADL supported

to ensure their nonrepudiation.

the implementation of privacy fulfillment

The system, structured to support the customer’susing privacy by design, risk analysis, and data

functions of planning, management, andprotection impact assessment.

monitoring of existing resources, as well as
communication to and from the outside, wasbuilt utilizing data and information from:BIG DATA? BIG SECURITY!

8VIEWPOINT

BIG DATA? BIG SECURITY!

ARTHUR D. LITTLE

9ARTHUR D. LITTLE

VIEWPOINT

CONCLUSIONSECURIT Y CONTINUOUS
IMPROVEMENTO R G A N I Z AT I O N S M U S T M A N A G ET H E E V O L U T I O N O F R E G U L AT I O N S
A N D T E C H N O L O G Y T R A N S F O R M AT I O N

Increases in data and digitalization processes have led to an
escalation of cyberattacks against companies and institutions
as well as to a continuously evolving regulatory environment
and a need for companies to constantly adapt to the changing
dynamics of the data economy. Thus, organizations must
invest in technologies for prevention and protection, whileat the same time provide communications and trainings toensure their people are aware of the culture of security as
good business practice. Overall, organizations must manage
the evolution of regulations and technology transformation,
paying particular attention to:
1

Assessing information security maturity and the levelof risk exposure2

Identifying and adopting frameworks to adapt tointernational standards and regulatory compliancerequirements3

Defining an adequate budget and embracing technology
improvements to proactively respond to the risks ofcyberattacks

BIG DATA? BIG SECURITY!

10

ARTHUR D. LITTLE

VIEWPOINTNOTESBIG DATA? BIG SECURITY!

11Arthur D. Little has been at the forefront of innovation since1886. We are an acknowledged thought leader in linking
strategy, innovation and transformation in technologyintensive and converging industries. We navigate our clients
through changing business ecosystems to uncover new growth
opportunities. We enable our clients to build innovation
capabilities and transform their organizations.
Our consultants have strong practical industry experience
combined with excellent knowledge of key trends and dynamics.
ADL is present in the most important business centers around theworld. We are proud to serve most of the Fortune 1000 companies, inaddition to other leading firms and public sector organizations.
For further information, please visit www.adlittle.com.
Copyright © Arthur D. Little – 2024. All rights reserved.