VIEWPOINT

2022

BEING CONCERNEDIS NOT ENOUGH
WHAT BOARDS SHOULD KNOWAND DO ABOUT CYBERSECURITYAUTHORSContinuous growth and diversification in the
cybercrime landscape, accelerated by the
COVID-19 pandemic, have increased the relevance

Maximilian Scherr
Tom Teixeiraof well-performing IT/operational technology (OT)

Dmytro Zaika

cybersecurity. But cybersecurity’s complexity

Michael Ludescher

inhibits understanding and is thus often relegatedto a mere part of the IT budget. Arthur D. Little’s
Cybersecurity Matrix enables targeted assessments,
allowing organizations to pinpoint key issues andprioritize remediation actions accordingly. These
readily understandable insights facilitate board
discussions that are long overdue.

ARTHUR D. LITTLE

VIEWPOINTCYBERSECURIT Y IS E VERINCRE ASING IN RELE VANCE

The escalation in damages is unprecedented andCybersecurity is a critical topic for both the

As a matter of course, this development did

private and public sectors. Since the firstnot escape the attention of insurance firms.

relatively harmless cyberattack in 1988, theCompanies are facing rapidly increasing

cybercriminal space has evolved to become apremiums, reflecting the surging demand for

major threat to the physical and nonphysicalcyberinsurance and the higher risk exposure,worlds alike. In response, governments andputting additional pressure on already limitedorganizations must allocate the resources

cybersecurity budgets. Therefore, executives

required to prevent cyberattacks against theirshould be aware not only of the increase in theinformation and operation systems. At the

number and severity of cyberattacks but, evensame time, companies are exposed to a rapidly

more importantly, about the changing threatchanging threat landscape as well as a recent

landscape.

puts cybersecurity well on its way to becoming
the most serious business threat of the future.

spike in cyberattacks due to the COVID-19
pandemic. Without a clear understanding ofMajor cyberattacks transform

cybersecurity, organizations will find it nearly

threat landscape

impossible to effectively protect against cyber

The examples included in the sidebar describe

threats.

some of the transformative cyber incidents

Between 2015 and 2020, the number ofagainst key points of global supply chains.

significant cyberattacks on key infrastructure

They demonstrate the real-world impact andestablishments, or economic crimes thatdiversification of cyber threats and reveal theexceeded US $1 million in losses, more thanimportance of management’s increased attention

tripled (see Figure 1). In 2021, total damages

on cybersecurity.

from cyberattacks exceeded $1 trillion worldwide,
up more than 50% from 2018 levels. Meanwhile,the conflict between Russia and Ukraine has
contributed its share of cyberattacks in 2022,
leading to a massive surge globally.

Figure 1. Number of cyber incidents with more than US $1

Figure1. Numberof cyber incidents with more than US $1 million in losses
millionin losses

145
136
Number of incidents

111

112

2018

2019

68

14

20

25

24

2009

2010

31

30

2011

2012

36

31

36

38

2015

2016

5
2006

2007

2008

2013

2014

2017

2020

2021

Source: Arthur D. Little, CSIS

BEING CONCERNED IS NOT ENOUGH

Source: Arthur D. Little, CSIS

2ARTHUR D. LITTLE

VIEWPOINT

4 recent transformative cyber incidents
1. First major cyber incident for operational technology. In 2015, a criminal group hacked
Ukraine’s electrical grid system, leaving approximately 230,000 homes without electricity
for up to six hours. The cyberattack marked the first major OT outage due to a cyber incident
in history.
2. Cyberattack with severe global impact. In 2017, Maersk was subject to one of the most
severe cyberattacks in recent history. Ransomware blocked internal systems, leaving thecompany unable to process customer orders. The shutdown of OT systems cost the company
in excess of $300 million in damages.
3. Cyber incident with potential impact on human health. In February 2021, hackers gained
access to the control terminal of a water treatment plant in the US state of Florida, thenincreased the amount of a toxic chemical in the water to dangerous levels. A plant operator
noticed the increase and immediately corrected the chemical levels. Nonetheless, the attack
exemplifies the vulnerability of key infrastructure with potential harm for human health.
4. Cyberattack on critical infrastructure. In June 2021, a hacking group launched aransomware attack against Colonial Pipeline on the East Coast of the US and forced the
shutdown of the pipeline as a precautionary measure. As a result of the shutdown, many gas
stations had to limit service due to fears of gasoline shortages. This attack exemplifies theimpact of cyber incidents on operators of essential services.

Cyberattacks on operational technology
The focus of cybersecurity has traditionallybeen on IT systems. However, in the last decade,cybercriminals have repeatedly targeted OT(see Figure 2). The growing number of attacks on
OT demonstrates that cybersecurity is not justabout protecting information but also aboutprocess safety. Cyber incidents increasingly bear

The traditional belief that OT is separated fromthe outside world no longer holds true due to theadvancing convergence of IT and OT systems.
As part of the fourth industrial revolution, orIndustry 4.0, the (Industrial) Internet of Things(IoT) is gaining a foothold in most organizations,leading to the deployment of more and more ITlike systems within OT environments to support
key processes. While companies see the vast

operational and physical risks that can lead to
Figure 2. Key
cyberattacks on operational technology
performance and efficiency gains associated withsignificant business interruption.

leveraging their operational data for advanced

Figure 2. Key cyberattacks on operational technology• USB stick andfile infection• Four zero-day
exploits• Prepared control
system–specificattacks• Watering holeattack• Open Platform
Communications
enumeration• Reconnaissanceleading tosystem-specificsabotage attacks• Custom network
scanner• Specific PLC
attack• OT protocol
scanning• OT protocol
scanning• Specific control
system reprogram• Safety systems
compromised• 64 industrial
control systemprocesses
targeted in theransomware‘s“kill list”

Stuxnet

Havex

BlackEnergy

Industroyer

Triton

EKANS

2010

2014

2015

2016

2017

2020

Source: Arthur D. Little, Darktrace

BEING CONCERNED IS NOT ENOUGH

3

ARTHUR D. LITTLE

VIEWPOINT

analytics purposes, they often neglect theadditional cybersecurity risks. In line with this,a 2021 study by Palo Alto Networks found that
96% of IT decision makers admit that their current
IoT security approach shows upside potential,
highlighting capabilities like threat protection,

REMOTE WORKING,REPRESENTED A
F U N D A M E N TA L C H A N G E
IN THE CYBERSECURIT Y
T H R E AT L A N D S C A P E

risk assessment, or asset management as theirmain pain points. Furthermore, the study foundthat 98% of all IoT device traffic is unencrypted
and 57% of IoT devices are vulnerable to mediumor high-severity attacks.

The pandemic marked a shift in working
patterns toward remote working, representing
a fundamental change in the cybersecurity threat

Exposing a growing number of physical devices

landscape. Workers moved from better-protectedto the outside world not only increases thecorporate networks to relatively unsafe and often

complexity of ensuring sufficient security

wrongly configured home networks, presenting

standards but also broadens a company’s attack

a critical vulnerability for corporate information.

surface (i.e., its sum of potential targets for a

In particular, a rise in ransomware attacks

cyberattack). The very nature of IoT devices, being

conducted via VPNs used for remote working

closely interconnected with each other, amplifies

access (as in the case of Colonial Pipeline),

the risk of spreading, since a compromised device

poses a significant cyber threat. Criminals

may contaminate an entire system.

exploit these newfound security deficiencies to

The growing number of cyberattacks on OT meansthat operators of critical services (such as oil andtheir advantage, accelerating the already growing
threat of cyberattacks.

gas suppliers or utility companies in their crucial

The work-from-home (WFH) culture thatrole within global supply chains) must ensure

developed during the pandemic is not anticipatedawareness and effective protection against cyberto end, with numerous studies estimating thatthreats all the way down to the shop floor.

25%-30% of the global workforce will continue to
WFH at least several days a week for the short andAcceleration of cyberattacks due to COVID-19
According to a 2020 study conducted by ADL,

medium term, meaning this increased risk is likely
to remain.

top management executives confirmed that the
COVID-19 pandemic required additional processes
and security measures for 36% of companies.
Moreover, 46% of companies have provided
employee training and 43% have implemented
additional awareness campaigns to ensure
data and information security.

BEING CONCERNED IS NOT ENOUGH

4

VIEWPOINT

BEING CONCERNED IS NOT ENOUGHARTHUR D. LITTLE

5ARTHUR D. LITTLE

VIEWPOINT

CORP OR ATE CHALLENGESWITH CYBERSECURIT Y

makers. Of course, international standards

To address cybersecurity successfully, businesses

reduced complexity. In its 2022 update of themust overcome three central challenges:

well-established ISO 27002, the International

1. Visibility. The inherent complexityof cybersecurity has to be translated
into understandable, action-oriented
recommendations for top management.
2. Resource allocation. Companies must
address the apparent mismatch between theeconomic damage of cyberattacks and theircybersecurity investments.
3. Measurement. Companies need sophisticatedbodies are already addressing this challenge by
gearing recent versions of their standards toward

Organization for Standardization serves as aprime example, not only reacting to the changing
threat scenarios but also discarding its 14 control
domains in favor of four more comprehensive
categories/themes as well as reducing the total
number of controls by means of merging or
minimizing redundancies. While such updates areundoubtedly a major stride toward the desiredgoal, the challenge of striking a balance between
maintaining the required technical level of detailcybersecurity measurement systems to track

while achieving general comprehensiveness,

progress and clearly communicate key issues

especially for top-level management, remains

to top management.

a crucial one.

1. Visibility
The complexity of the cybersecurity topic
inhibits key management attention and focusedaction. Often, C-level executives do not easily
understand the technical information operational

In addition to the challenges of communication,
the standards’ mode of assessment is targeted
toward compliance rather than recommendations
for improvements. ISO and IEC complianceis examined with a questionnaire type ofassessment, whereas expert-type assessments

IT staff shares. To address this issue, manyare often missing.

corporates adhere to international standards as

Real expert-type assessments are geared towarda benchmark of good cybersecurity practice.

a “show me, don’t tell me,” attitude and enable

There are two commonly applied standards within

the assessment of cybersecurity performance

IT and OT cybersecurity, respectively: ISO 27001
and IEC 62443. Both standards include multiple
domains and secondary objectives with highlevels of technical detail that make them difficultin action. For example, an assessor may ask
a firewall operator to access certain logs orshow how security configurations have been
implemented. Measuring compliance with ISO/

Figure 3. Global
costof cybercrime
relativeIEC
toorcybersecurity
similar standards is a minimum (but not
to interpretand communicate
to key decision
sufficient) requirement that needs to be set
investment
Figure 3. Global cost of cybercrime relative to cybersecurity
investment

before conducting an expert-type assessment.
2. Resource allocation

Global cost of damages:$945 billion

In 2020, the global costs of cybercrime exceeded$1 trillion, according to a McAfee report. The
loss in damages from cyberattacks has reachedan estimated $945 billion, while companies

Global cybersecurity investment:$145 billion

have invested only $145 billion in cybersecurity(see Figure 3).

Source: Arthur D. Little, McAfee

BEING CONCERNED IS NOT ENOUGH

6

ARTHUR D. LITTLE

VIEWPOINT

On an organizational level, the mismatch between

Calculations of ROI indicators of a cybersecurity

potential damages and preventive investments

program are especially complex, as returns

looks similar. McAfee estimates the averageon cybersecurity can only be reflected as thecost of a data breach for American corporates

opportunity cost of damages from a cyberattack

is approximately $8.64 million, while an averageor an estimated value of cyber risk documentedorganization spends only $2.6 million on

by corporate risk and compliance. To address

cybersecurity. This clear gap leaves organizations

this challenge, ADL has compiled preventive andvulnerable to growing cyber threats.

reactive measures, indicative of the preparation

In an attempt to close the resource gap andto defend an organization effectively against
cyberattacks, information security is becoming
one of the top priorities within the IT budget.
IT spending (including for cybersecurity) is often
seen as a cost driver rather than an enabling
factor for businesses. This means that duringcrises, companies tend to reduce their respective
budget allocation.
Moreover, companies oftentimes prioritize
cybersecurity spending only after a major

levels of organizations against cyberattacks.
These include “lagging” KPIs like criticalvulnerabilities and security incidents that point
to cybersecurity issues that already exist inorganizations. Alternatively, “leading” indicators
include KPIs (e.g., threat intelligence, total risk
exposure, and security awareness) that point at
general preparedness (see Figure 4).

ME ASUREMENT &AC TION PL AN

incident. The potential reduction in cybersecurity
investment is a worrying trend, particularly
given the continuous increase in the number ofcyber threats. This mismatch shows the need tofocus financial resources on the most impactfulmeasures, which requires a clear prioritization
framework.

Digesting cybersecurity standards
Cybersecurity must be broken down into its
components to enable targeted action. As
mentioned earlier, there are several commonly
applied standards within IT and OT cybersecurity,
including ISO 27001, IEC 62443, and NIST
(see Figure 5). These standards include multiple

3. Measurement

domains and secondary objectives with highIt is impossible to guarantee full protection fromlevels of technical detail. Consequently,

cyber threats. However, certain indicators can

the standards are difficult to interpret andhighlight the increased risk to better preparecommunicate to senior decision makers, making

organizations. Still, holistic measurement ofprioritized action planning with corresponding

cybersecurity effectiveness is challenging.

resource assignments challenging.

Figure 4. Examples of cybersecurity KPIs
Figure 4. Examples of cybersecurity KPIs
LEADING INDICATORSLAGGING INDICATORS• Cyber threat intelligence(# of threats to an industry)• Critical vulnerabilities(On server, client, network infrastructure)• Cyber risk exposure($ value of documented risks)• Security incidents(By priority)• Cybersecurity maturity level(Score 0-5)

• Recorded financial impact($ impact from cybersecurity incidents)• Security awareness(Corporate campaign metrics)• Penetration test results(# of findings in remediation)

Source: Arthur D. Little

BEING CONCERNED IS NOT ENOUGH

7

ARTHUR D. LITTLE

VIEWPOINTADL Cybersecurity Matrix

Each intersection in the matrix is given a score

From its experience in the development andimplementation of cybersecurity strategies,
ADL has developed a Cybersecurity Matrix,1 which
breaks down the inherent complexity of the topic
for comprehensive understanding (see Figure 6).
The framework allows for a deep dive along six
cybersecurity domains and six functional areas,each focusing on critical tools or capabilities forcoping with the cyber threat landscape.
1based on an expert-led assessment using theControl Objectives for Information and Related
Technology (COBIT) maturity model, withmaturity definitions ranging from 0 (nonexistentcapability) to 5 (optimized capability). This
assessment employs a “show me, don’t tellme” approach, where each statement from anorganization’s cybersecurity expert is checked
live (e.g., by interviewing company-internal
subject matter experts, accessing the firewalls’

Co-developed with Infinity Grey Ltd on the basis of their Cyber
Maturity Model & its embedded Enterprise Cybersecurity
Architecture Framework.

Figure 5. Global cybersecurity standards

management console).

Figure 5. Global cybersecurity standards
ISO
27001

IEC
62443

A.5 – Information security policies

A.12 – Operations security

A.6 – Organization and information security

A.13 – Communications security

A.7 – Human resource security

A.14 – System acquisition, development, and maintenance

A.8 – Asset management

A.15 – Supplier relationships

A.9 – Access control

A.16 – Information security incident management

A.10 – Cryptography

A.17 – Information security aspects of business continuity mgmt.

A.11 – Physical and environmental security

A.18 – Compliance

FR 1 – Identification & authentication control

FR 5 – Restricted data flow

FR 2 – Use control

FR 6 – Timely response to events

FR 3 – System integrity

FR 7 – Resource availability

18 domains
with 32
secondaryobjectives

7 domainswith 51
secondaryobjectives

FR 4 – Data confidentiality

NIST

ID – Identify

RC – Recover
5 domainswith 23
categories

PR – Protect
DE – Detect
RS – RespondSource: NIST, ISO, IEC

Figure 6. Arthur D. Little Cybersecurity Matrix
Figure 6. ADL Cybersecurity Matrix
FUNCTIONAL AREAS
Source: NIST, ISO, IEC

Suitably qualified Operational& experienced
readiness
peopleTools &
technologies

Processes &procedures

Policies &standards

Governance &assurance

Identity & accessmanagement

DOMAINS

Cryptography & key
management

Data trust
management

Security & event
management

Threat & vulnerability
management

Business resiliencemanagement
Source: Arthur D. Little, Infinity Grey Ltd

Source: Arthur D. Little
BEING CONCERNED IS NOT ENOUGH

8

ARTHUR D. LITTLE

VIEWPOINT

The framework supports companies by providing

suitable qualifications, insufficient budgets,the granularity they need to unveil their mainlargely manual tools, and no regular and defined

pain points, while still offering the measurability

governance structure to assure key stakeholders

and conciseness needed for raising awarenessof the progress in this capability.

among upper management. It effectively creates

These findings provide an outline for a clear

a baseline for an organization’s cybersecurity

and actionable roadmap for the Threat andprogram and allows for an actionable plan to

Vulnerability Management domain with a focus

ensure that organizations spend cybersecurity

on increasing FTEs, qualifications of existing

budgets on measures with the highest impact.

staff, assigning additional budget, procuring
state-of-the-art tools, and setting up a

Creating an action plan to target

governance process focused on the domain.

underperforming areas

Such actions can be defined for each intersection

The assessment based on the sampleof the matrix to achieve a targeted maturity level

Cybersecurity Matrix shown in Figure 7 delivers

across the organization.

an average maturity score of 2.8 (defined

The Cybersecurity Matrix based on theprocess). However, it is more important toassessment delivers a comprehensive set ofobserve the scores of each domain or functional

recommendations to address intersections of thearea. In this sample assessment, Threat andmatrix and improve the maturity toward a level

Vulnerability Management is one of the weakest

targeted by an organization.

capabilities due to a lack of employees with

Figure 7. Arthur D. Little Cybersecurity Matrix: Sample
assessment result

Figure 7. Arthur D. Little Cybersecurity Matrix: Sample assessment result
Suitably
qualified &experienced
peopleOperational
readiness

Identity & accessmanagement

3

3

4

3

4

3

3.3

Cryptography &key management

2

3

2

3

2

2

2.3

Data trust
management

3

4

4

4

4

3

3.7

Functional
areas
Domains

Tools &
technologies

Policies &standards

Processes &procedures

Governance& assurance
Avg.

Security
information &event management

3

3

2

3

3

3

2.8

Threat &vulnerability
management

2

2

2

3

3

2

2.3

Business resiliencemanagement

3

3

2

2

2

3

2.5

Average

2.7

3.0

2.7

3.0

3.0

2.7

2.8

Each quadrantof the matrix
evaluated basedon COBIT scale:0

Non-existent1

Ad hoc2

Repeatable but
intuitive

3

Defined process

4Managed andmeasurable

5

Optimized

Source:D. Little
Source:ArthurArthur
D. Little

BEING CONCERNED IS NOT ENOUGH

9

VIEWPOINT

BEING CONCERNED IS NOT ENOUGHARTHUR D. LITTLE

10ARTHUR D. LITTLE

VIEWPOINT

CONCLUSIONADDRESSING CYBERSECURIT Y
AT T H E B O A R D L E V E L

BOARDS CAN ME ASURE , MANAGE , AND
COMMAND CYBERSECURIT Y PERFORMANCET O W A R D A S U S TA I N A B L E R E D U C T I O N O F R I S KCybercrime is a growing threat that will require C-level attention inorganizations across the globe. We offer four steps boards can taketoward establishing fit-for-purpose cybersecurity capabilities:1	Engage an objective expert view on the status quo of theorganization’s cybersecurity maturity. Ideally, this assessment
should ensure the necessary level of granularity while still providing
readily understandable insights and priorities for the C-level audience(e.g., ADL’s Cybersecurity Matrix).
2

Ensure regular oversight of the organization’s key indicators forcybersecurity performance, both leading and lagging, providing
assurance that the controls in place are offering the right level ofprotection.

3

Review fact-based and unvarnished updates on a regular basis.
This not only facilitates progress tracking but also ensures that
resources are allocated in the most effective way for reaching theintended maturity level.

4	Enable the required governance and funding to reach theorganization’s target state, based on a dedicated action plan,
while ensuring identified vulnerabilities are immediately addressed.
By following these steps, boards can measure, manage, and commandcybersecurity performance toward a sustainable reduction of risk.

BEING CONCERNED IS NOT ENOUGH

11

Arthur D. Little has been at the forefront of innovation since1886. We are an acknowledged thought leader in linking
strategy, innovation and transformation in technologyintensive and converging industries. We navigate our clients
through changing business ecosystems to uncover new growth
opportunities. We enable our clients to build innovation
capabilities and transform their organizations.
Our consultants have strong practical industry experience
combined with excellent knowledge of key trends and dynamics.
ADL is present in the most important business centers around theworld. We are proud to serve most of the Fortune 1000 companies, inaddition to other leading firms and public sector organizations.
For further information, please visit www.adlittle.com.
Copyright © Arthur D. Little – 2022. All rights reserved.