In my role as a sales and business development consultant, I come in contact with sales professionals and business executives across numerous industries. I understand the trends involved with the integration of physical security, IT infrastructure and cyber solutions. The emergence of the Internet of Things (IoT), perhaps more appropriately described as the “Integration of Things,” has created more visibility to the convergence model generally and cyber threats specifically. That said, I see a fundamental problem with sales organizations, outside of the cyber industry, with initiating a cyber discussion. This is the first step in aligning cyber threats in the context of overall business risk, and for providing the managed services and secure products that the industry increasingly requires.

This Cyber 101 Discussion is more of an informal conversation than a deep technical discussion. Cybersecurity is a confusing topic to many people and is at times assumed to be overly complex. In reality, it is a crime and espionage discussion with a rich history and interesting as a business case study. Put into this context, it is actually a compelling narrative and promotes a lively conversation that inevitably turns to the topic of operational risk and specific business issues.

The first step is to know your cyber history. This does not have to entail a debate as to when and how hacking evolved. I believe an appropriate starting point would be the first Gulf War. Perhaps the 1990s are ancient history for some, but most senior executives can identify. The important fact was the ease at which the United States military demonstrated technical dominance over the Iraqi army. Nightly news casts of American generals proudly showing video clips of guided missiles accurately striking buildings and vehicles was enough to send chills down the spines of our nation-state adversaries, and jump start their offensive cyber commands.

“I believe the Chinese concluded from the Desert Storm experience that their counter approach had to be to challenge America’s control of the battle space by building capabilities to knock out our satellites and invading our cyber networks. In the name of the defense of China in this new world, the Chinese feel they have to remove that advantage of the U.S. in the event of a war”.

- Admiral Mike McConnell (ret.),
former Director NSA,
and Director National Intelligence

Not to be left out, the Russian military also accelerated its Cyber capabilities (post-Gulf War I) as well. In fact, many “retired” military cyber warriors established the early Russian cyber criminal syndicates, and promoted global cybercrime as a business model.

As a result, cybercrime evolved, and Cyber Crime as a Service eventually exploded.  It is a well-known operational fact that you only exist as a significant Russian cybercriminal if you abide by three hard and fast rules:

1. You are not allowed to hack anything within the country;

2. If you find anything of interest to the government you share it;

3. When called upon for “patriotic cyber activities,” you serve.

In exchange, you are “untouchable” and immune from prosecution.

Tom Kellermann, CEO of Strategic Cyber Ventures, is a cyber intelligence expert, author, professor, and leader in the field of cybersecurity serving as a Global Fellow for the Wilson Center. He is the previous Chief Cybersecurity Officer for Trend Micro, and Vice President for Security at Core Security. Kellermann has mentioned to me that existence of approximately 200 “cyber ninjas” globally: truly elite gifted hackers. This select group of black hat ninjas realized they could produce “malware for dummies,” (or criminals with average skill sets), along with online “how to hack” support services, in return for a cut of the profits. This business model returned more personal revenues at scale, compared to individual hacking activities, with much less risk. These operations created the original “Malware as a Service” business models, and as a result, cybercrime has since exploded. (By the way, the model provides a recurring monthly revenue stream.)

According to The Serious Organized Crime Agency (SOCA), global cybercrime has surpassed narcotics trafficking in illicit revenues, and in the United Kingdom, more than 50 percent of all crime is now cyber-related. Kellerman added that cybercrime has transitioned from traditional burglary to digital home invasion: “The economic security of the West is in jeopardy.  Civilizing cyberspace must become a national priority.”

Research firm Cybersecurity Ventures (not to be confused with Strategic Cyber Ventures) produced a report that predicts that cybercrime worldwide will grow from $3 trillion in 2016 to more than $6 trillion annually by 2021! As a comparison, the entire Gross Domestic Product (GDP) for the U.S. was $14 trillion in 2016.

Cybercrime today is professional, organized, sophisticated, and most importantly “relentless.” These are not personal attacks. If you have any digital footprint, you are a target, period. The entire internet can be scanned for open ports within a few days, and IP cameras being activated on the Internet are normally pinged within 90 seconds. You can’t hide very long. When it comes to security, the old adage “Offense informs defense” is appropriate when protecting your specific business operation. A former client of mine, John Watters, CEO of iSIGHT PARTNERS (now FireEye), used an example: “A burglar and an assassin can use the same tools and tradecraft to gain entry to a location, but the intent, once inside, is very different. One wants your property; the other wants to kill your family. Prepare yourself accordingly.”

Another challenge moving forward is that the risk of cyber attack is growing. This is a dual-edged sword in many regards. IoT and the Industrial Internet of Things (IIoT) open a much wider attack surface of many more devices. However, the operational efficiencies and human productivity advances cannot be denied and will move forward. This situation creates a new reality; essentially cyber threats are morphing from a virtual threat into a physical danger. Matt Rosenquist, Cyber Security Strategist, Intel Security Group, explained in his 2017 ISC West Keynote address that the same controls that provide auto assist to parallel park your vehicle can be hacked to force a car (or hundreds of cars) to accelerate to high speeds and turn abruptly, causing fatal accidents. Imagine for a moment what that hack does to that specific automobile manufacturer's brand reputation? Would the corporation even hope to survive?

Planes, trains and automobiles are just the beginning. Intelligent buildings, campuses, hospitals, retail outlets, branch offices and mobile emergency services, etc., all need to be secured. Moving forward, security, followed closely by privacy protections, will be at the top of all buying requirements to win business.

The bottom line is that cybersecurity, like terrorism or tornados, is about risk management. This is a discussion that owners, managements and boards of directors know well. It is the responsibility of the sales professional to educate prospects and customer organizations to the sophisticated level of cyber risk that exists today and into the future. This is why understanding and explaining the evolving cybercrime business model is so important as an initial discussion.

In 2017, I have had the “Cyber 101 Discussion” with sales leadership and executives from many companies and industries:

1. The regional insurance firm in Texas (1,000 employees) that recognizes a huge and expanding cyber insurance market opportunity generating more than $3.5 billion in 2016, and growing at 70 percent annually! Yet their sales organization does not know the first thing about starting the cyber dialogue with potential clients. ‘‘We know insurance, not cybersecurity.”

2. The global video camera distributor that needs assistance in aligning marketing and sales messaging to answer customer concerns about cybersecurity. The industry needs a response to the Mirai botnet attacks that virtually guarantee that the Internet will be flooded by hacks of new botnets powered by insecure routers, IP cameras, digital video recorders and other easily hackable devices.

3. The physical security integrator that recognizes the need to provide secure solutions and endpoints for their enterprise customers, but needs to provide internal cyber education, while recruiting strategic partners offering cyber solutions and support resources.

4. The domestic security monitoring company that now offers cyber managed solutions to the SMB market, but struggles with positioning a compelling ROI, and explains that customers cannot “quantify” the cyber risk to their business? (Hint: That’s the job of your sales organization; your customers need cyber education.)

It begins with a cyber sales comfort level within your own organization. Cyber education allows you to pass knowledge on to others as a trusted advisor. Get the Cyber 101 Discussion started as a first step. Additional education and specific solutions can always be provided to secure passwords, mobile devices, access control, VMS, encryption and backups, etc. It’s a long list, but security managed services are providing recurring revenues and need to be positioned correctly.

Whether providing cyber insurance, hardening physical security equipment, or selling secure managed services, the Cyber 101 discussion starts with understanding cyber history and the evolution of adversary intent. Today’s cyber threat is a component in the new definition of digital business risk. Not always overly technically complicated, but essential to be countered and monitored constantly.