The failure of enterprise to prepare for cyberattacks

Late last month, Zeitgeist went with friends to his local theatre to see “Teh [sic] Internet is a Serious Business”. The play, a story of the founding of the hacktivist group Anonymous, was the most well-publicised dawn of cyberattacks on businesses and governments. The organisation, at its best, set it sights on radical groups that promoted marginalisation of others, whether that was the Church of Scientology in the US or those trying to dampen the Arab Spring in Tunisia. This collective, run by people, some of whom were still in school, showed the world how vulnerable institutions were to being targeted online. We wrote about cybersecurity as recently as this summer, summarising the key points in a recent report from The Economist on what was needed to mitigate against future attacks and how to reduce the damage such attacks inflict. The issue is not going away (and in fact is likely to become worse before it gets better).

It was back in January that management consultancy McKinsey produced a report, ‘Risk and responsibility in a hyperconnected world: Implications for enterprises’, where they estimated the total aggregate impact of cyberattacks at $3 trillion. There is much to be done to avert such losses, but the current picture is far from rosy. Most tech executives gave their institutions “low scores in making the required changes”, the report states; nearly 80% of them said they cannot keep up with attackers’ – be they nation-states or individuals – increasing sophistication. Moreover, though more money is being directed at this area, “larger expenditures have not translated into an increased maturity” yet. And while the attacks themselves carry potentially devastating economic impact on a company, their prevention comes at a price too for the business, beyond the financial. McKinsey reports that security concerns are delaying mobile functionality in enterprises by an average of six months. If attacks continue, the consultancy posits this could result in “a world where a ‘cyberbacklash’ decelerates digitization [sic]”. Revelations about pervasive cyberspying by Western governments on their own citizens could well be a catalyst to this. Seven points are made in the report for enterprises to manage disruptions better:

1. Prioritise the greatest business risks to defend and invest in.
2. Provide a differentiated approach to defence of assets, based on their importance.
3. Move from “simply bolting on security to training their entire staff to incorporate it from day one into technology projects”.
4. Be proactive; develop capabilities “to aggregate relevant information” to attune defence systems
5. Test. Test. Test again.
6. Enlist CxOs to help them understand the value in protection.
7. Integrate risk of attack with other corporate risk analysis

Given the amount of business and social issues that involve digital processes – “IP, regulatory compliance, privacy, customer experience, product development, business continuity, legal jurisdiction” – there is a huge amount of disagreement about how much state involvement there should be in the degree to which enterprises must take steps to protect themselves. This is an important point for discussion though, and we touched on it when we wrote about cyberattacks previously.

But that report was way back in January, things must have solved themselves since then, right? Last week, PwC reported that corporate cyber security budgets are being slashed, even while cyberattacks are becoming far more frequent. The FT reported that global security budgets fell 4% YoY in 2014, while the number of reported security incidents increased 48%. Bear in mind these are only reported incidents. This is potentially no bad thing, if we’re to go by McKinsey’s diagnosis of too much money being thrown at the problem in the first place. At the same time, it’s not exactly comforting.

Only a few days after PwC’s figures were published, JP Morgan revealed that personal data for 76 million households – about two-thirds of total US households – had been “compromised” by a cyberattack that had happened earlier in the year. Information stolen included names, phone numbers and email addresses of customers. It was also revealed that other financial institutions were probed too. Worryingly, the WSJ reports that investigators disagree on what exactly the hackers did. It was also unclear who was to blame; nation state or individual. Such disagreements over the ramifications of the attack, the identity of the attackers as well as the delayed revelation of the attack itself, illustrate just how necessary transparency is, if such attacks are to be better protected against and managed in the future.

For those in London at the end of the month, The Economist is hosting an event for those who apply, on October 21, examining “how businesses can and should respond to a data breach, whether it stem from a malicious insider, an external threat or simple carelessness”. Hope to see you there.

On newspapers – Time (Inc.) for a shift in strategy

It’s no secret that the publishing industry is struggling mightily as customers shift from paying for physical newspapers and magazines to reading information online, often for free. The shift has caused ruptures among other places at that bastion of French journalism, Le Monde, with the recent exit of the editor as staff rued the switch to online. So-called ‘lad’s mags’, the FHMs and Loaded magazines of the world, have been hit particularly hard, as the family PC and dial-up internet gave way to personal, portable devices and broadband connections, which provided easier access to more salacious content than the likes of Nuts could ever hope to provide. FHM’s monthly circulation is down almost 90% from a 1998 peak, according to the Financial Times. Condé Nast have pushed bravely into the new digital era, launching a comprehensive list of digital editions of its wares when the iPad launched in 2010. More recently, the company launched a new venture, La Maison. In association with Publicis and Google, the idea is to provide luxury goods companies with customer insights as well as content and technology solutions. We’ve often written about the need for more rigorous customer insights in the world of luxury, so it’s refreshing to see Condé Nast innovating and continuing to look beyond newsstand sales. We’ve written about other ways publishers are monetising their content here and here.

Time Warner is not alone then in its struggles for new ways of making money from previously flourishing revenue streams. According to The New York Times, Time Warner will be spinning off its publishing arm, Time Inc., with 90 magazines, 45 websites and $1.3bn in debt. In 2006, the article reports, Time Inc. produced $1bn in earnings, which has now receded to $370m. Revenue has declined in 22 of the last 24 quarters. This kind of move is not new. Rupert Murdoch acted in similar fashion recently when he split up News Corporation, creating 21st Century Fox. But with the publishing side of the business there were some diamonds in the rough for investors to take interest in; a couple of TV companies, as well as of course Dow Jones’ Wall Street Journal, which has been invested in heavily. Conversely, the feeling of the Time Inc spin-off was more one of being put out to pasture, particularly as the company will not have enough money to make any significant acquisitions. Like the turmoil at Le Monde, there have been managerial controversies, as those seeking to shake things up have tried to overcome historical divisions between the sales and editorial teams – something other large business journalism companies are reportedly struggling with – only to be met with frustration.

Setting that aside, Time Warner moved swiftly. A day later, the FT reported that the company was “finalising an investment” in Vice Media. We have written extensively about Vice previously, here. The company certainly seems to know how to reach fickle millennials, through a combination of interesting, off-beat journalism, content designed to create its own news, as well as compelling video documentaries that take an unusual look at topical subjects. Such an outlook however does not preclude it from partnering with corporations. As a millennial myself, it seems what people look for from those like Vice is authenticity, rather than the vanilla mediocrity arguably offered by others. We don’t mind commercialism as long as it’s transparent. It does not jar then when Intel is a major investor in its ‘content verticals’, or when last year 21st Century Fox invested $70m in the company. This bore fruit for the movie studio most recently in a tie-up promoting the upcoming Dawn of the Planet of the Apes. The sequel takes place 10 years after the 2011 film, and Fox briefed Vice to create three short films that would fill in the gaps. A great ploy, and the result is some compelling content to keep fans engaged in the run-up to the film’s release, particularly in territories where the film opens after the US market. Such activity is far beyond the purview of the traditional newspaper. But this is not necessarily a bad thing. Publishers must face up to the reality that newspapers alone will not deliver enough revenue to be sustainable. Seeking other content revenue streams while engaging in strategic partnerships with other companies looks, for now, to be a winning formula.

UPDATE 08/07/14: When it comes to engaging with millennials, mobile is most definitely the medium of choice. The FT reported today on Cosmopolitan magazine’s 200% surge in web visitors, year on year in May. Fully 69% of page views were from mobile devices (compared to a 25% average for the rest of the web). The publication has also wised up to the type of content this group likes to consume, as well as create. Troy Young, Hearst’s president of digital media, said the new site is “designed for fast creation of content of all types… Posts aren’t just text and pictures. They’re gifs, Tweets, Instagrams.” Mobile will only get the company so far though. PwC thinks US mobile advertising spending will account for only 4.6% of total media and entertainment advertising outlays this year. Cosmo is looking beyond mobile though to “exclusive events or experiences”, perhaps along the same lines as those other businesses are practicing who are looking for additional revenue streams. The article suggests users might “pay to see the first pictures of an occasion like Kanye West’s and Kim Kardashian’s recent wedding”. Beggars can’t be choosers.

UPDATE 10/07/14: Have all these corporate manoeuvres on the part of Time Warner been in the service of making itself appear an attractive acquisition? As the famous and clandestine Sun Valley conference takes place this week, rumours abounded that Google or 21st Century Fox were both interested in buying TW. This according to entertainment industry trade mag Variety, which commented, “Time Warner could be an attractive target. Moreover, unlike Fox or Liberty Media, it is not controlled by a founder or a founder’s family and with a market cap of $63.9 billion it is a relative bargain compared to the Walt Disney Co. and its $151 billion market cap”.