The failure of enterprise to prepare for cyberattacks

Late last month, Zeitgeist went with friends to his local theatre to see “Teh [sic] Internet is a Serious Business”. The play, a story of the founding of the hacktivist group Anonymous, was the most well-publicised dawn of cyberattacks on businesses and governments. The organisation, at its best, set it sights on radical groups that promoted marginalisation of others, whether that was the Church of Scientology in the US or those trying to dampen the Arab Spring in Tunisia. This collective, run by people, some of whom were still in school, showed the world how vulnerable institutions were to being targeted online. We wrote about cybersecurity as recently as this summer, summarising the key points in a recent report from The Economist on what was needed to mitigate against future attacks and how to reduce the damage such attacks inflict. The issue is not going away (and in fact is likely to become worse before it gets better).

It was back in January that management consultancy McKinsey produced a report, ‘Risk and responsibility in a hyperconnected world: Implications for enterprises’, where they estimated the total aggregate impact of cyberattacks at $3 trillion. There is much to be done to avert such losses, but the current picture is far from rosy. Most tech executives gave their institutions “low scores in making the required changes”, the report states; nearly 80% of them said they cannot keep up with attackers’ – be they nation-states or individuals – increasing sophistication. Moreover, though more money is being directed at this area, “larger expenditures have not translated into an increased maturity” yet. And while the attacks themselves carry potentially devastating economic impact on a company, their prevention comes at a price too for the business, beyond the financial. McKinsey reports that security concerns are delaying mobile functionality in enterprises by an average of six months. If attacks continue, the consultancy posits this could result in “a world where a ‘cyberbacklash’ decelerates digitization [sic]”. Revelations about pervasive cyberspying by Western governments on their own citizens could well be a catalyst to this. Seven points are made in the report for enterprises to manage disruptions better:

1. Prioritise the greatest business risks to defend and invest in.
2. Provide a differentiated approach to defence of assets, based on their importance.
3. Move from “simply bolting on security to training their entire staff to incorporate it from day one into technology projects”.
4. Be proactive; develop capabilities “to aggregate relevant information” to attune defence systems
5. Test. Test. Test again.
6. Enlist CxOs to help them understand the value in protection.
7. Integrate risk of attack with other corporate risk analysis

Given the amount of business and social issues that involve digital processes – “IP, regulatory compliance, privacy, customer experience, product development, business continuity, legal jurisdiction” – there is a huge amount of disagreement about how much state involvement there should be in the degree to which enterprises must take steps to protect themselves. This is an important point for discussion though, and we touched on it when we wrote about cyberattacks previously.

But that report was way back in January, things must have solved themselves since then, right? Last week, PwC reported that corporate cyber security budgets are being slashed, even while cyberattacks are becoming far more frequent. The FT reported that global security budgets fell 4% YoY in 2014, while the number of reported security incidents increased 48%. Bear in mind these are only reported incidents. This is potentially no bad thing, if we’re to go by McKinsey’s diagnosis of too much money being thrown at the problem in the first place. At the same time, it’s not exactly comforting.

Only a few days after PwC’s figures were published, JP Morgan revealed that personal data for 76 million households – about two-thirds of total US households – had been “compromised” by a cyberattack that had happened earlier in the year. Information stolen included names, phone numbers and email addresses of customers. It was also revealed that other financial institutions were probed too. Worryingly, the WSJ reports that investigators disagree on what exactly the hackers did. It was also unclear who was to blame; nation state or individual. Such disagreements over the ramifications of the attack, the identity of the attackers as well as the delayed revelation of the attack itself, illustrate just how necessary transparency is, if such attacks are to be better protected against and managed in the future.

For those in London at the end of the month, The Economist is hosting an event for those who apply, on October 21, examining “how businesses can and should respond to a data breach, whether it stem from a malicious insider, an external threat or simple carelessness”. Hope to see you there.

Can great creative work save the finance sector?

“Marketing has always combined facts and judgement: after all, there’s no analytic approach than can single-handedly tell you when you have a great piece of creative work.”

– McKinsey & Co., Measuring Marketing’s Worth

Capitalism has come in for a bit of a knocking of late. Recently, the Futures Company found that 86% thought “big business” maximised profits at the expense of customers and communities (not helped by another recent poll stating 51% of top financial services executives think businesses should just be about making money). The antipathy is not a recent phenomenon and hardly one confined to the fringe. John Maynard Keynes, whose ideas framed modern macroeconomics, said capitalism is “not virtuous [and] doesn’t deliver the goods”. And while there was a short period when such sentiment was only to be found in places like Pyongyang, these feelings are now more pervasive, particularly against the driving force of capitalism, the finance sector. Can marketing help shift perceptions?

From the outside looking in, it would be difficult to say that some of the wounds are not self-inflicted. Multiple fiascos have led to much head-shaking and hand-wringing within the industry. The furore has ceased to abate as politicians score cheap points for fingering the blame on bankers, and lionised institutions like Goldman Sachs suffer massive public relations disasters (including a part ownership stake in a prostitution ring). The manipulation of the LIBOR scheme and subsequent reforms reveal no quick end in sight to a period of immense negative exposure that began with the global recession four years ago.

So the image of finance is indisputably tarnished right now. Marketers are trying to change this, in different ways. Many Western financial institutions have been around for a while; the symbolism of such longevity can serve as a valuable asset for brands. Coincidentally, this year sees Citigroup – while dealing with its turbulent present – celebrate its 200^th anniversary. They’ve had a broad above-the-line campaign celebrating their place in history, putting their relative achievements – helping fund the building of the Panama Canal – alongside other important moments in time. Citi also have their eye on the future too, making a concerted push in areas of sustainability, recently managing to become the first bank to achieve LEED (Leadership in Energy and Environmental Design) certification for 200 projects from the U.S. Green Building Council. The question is whether leveraging history and sustainability – both of which arguably convey a sense of trusted consistency, rather than reckless risk-taking – with advertising can help address a serious deficit in consumer affinity for the finance sector. Does it even matter? If we assume banker-bashing is an irrational emotion, and the whole sector is tarnished with the same brush, how much sway does it have over the rational part of our brain that must decide where and how to invest our money?

Several banking brands rely on the prestige of their historical affiliations, and have found themselves no safer from customer ire. It can be hard to seek engaging differentiation in a commoditised industry where the power of switching costs can a play a strong role. A PwC report from July summarises, “Many consumers remain loyal due simply to the absence of a negative because it is often easier to put up with something that is less than perfect than go to the trouble, and potential expense, of switching”. So what else can be done to wake potential customers from this inertia?

It’s interesting to see Morgan Stanley take a decidedly more personal tack, with a new campaign, “What If?”. Shifting focus away from the company as a faceless monolith, the WSJ said the aim is to make the company seem “like your neighborly [sic] stock picker”. The creative itself is beautiful, showcasing professional types with aspects of business and social responsibility framing their translucent faces. It attempts to convey a personalised and considerate attitude that includes but also goes beyond profit-making. It broadly taps into themes in a new book. “Positive Linking”, by Paul Ormerod, sets out to dismiss the outdated notion that people are driven by personal, “rational utility maximisation” and instead claims they are more interested in aiding the network to which they belong, realising this will help them too. This in essence is a slightly less selfish form of capitalism.

“I owe the public nothing”, J.P. Morgan was once quoted as saying. Have times changed much since? The problems with the world of finance are too numerous for this article. The crisis of confidence has begun to have an effect on recruiting, as MBA graduates turn their learned eyes to more reputable sectors. Although it may not seem like it now, customer perceptions of brands within this sector are malleable. Any one that can position itself as an outlier in what is currently seen as a pernicious industry will have much to gain. The tail cannot wag the dog though. If these businesses are to change, they must back up their ambitions with operational changes that reduce risk and ensure profits sit alongside dedication to the broader lifestyle their advertising evinces.