It is requisite to start every NACD session on boardroom oversight of cybersecurity with the adage: “There are two types of companies: those that know they have been hacked and those that don’t.” And so begins the one- to two-hour panel discussions—experts in cyber technology outlining and explaining the various methods that have already been employed to hack into companies. Understandably, attendees usually leave these sessions a bit pale and speechless.
Cyberattacks on the private sector are a reality, not merely a threat. In 2013, 50 percent of companies with more than 5,000 employees surveyed by the Ponemon Institute reported one or more phishing attacks, a figure that has nearly doubled since 2009. Further, it is those at the higher levels of organizations that are targeted in attacks. In a recent Verizon report on data breaches, it was reported that executives—with higher public profiles and access to secure information—top the list of employee categories targeted in phishing attacks.
Oversight of cybersecurity is at the intersection of national security and the private sector. In the most recent issue of NACD Directorship magazine, Jeff Cunningham, in “The Art of Cyber War,” details the evolution of the cyber battle currently ensuing between China and the United States. Under Chairman Mao, China was defended by the Red Guard. Today, however, the Red Guard has been replaced by “digital warriors,” expert in technology and the English language, working from residential areas of China. In a report representing the culmination of six years of research from Mandiant—an American security company—Chinese hackers have stolen technology blueprints, negotiating strategies, and manufacturing processes from more than 100, mostly American, companies.
At NACD’s Spring Forum this week, cybersecurity expert Richard A. Clarke summarized the current environment: “China does not want to fight the United States in a military war, they want an economic war. You have the Chinese government against your company.” During this session, however, Clarke and Karl Hopkins from SNR Denton went beyond the harsh realities of cyber risk to provide guidance that directors can use at their next board meeting.
Understand you are on your own. The government’s cyber defense budget is allocated toward the military and national security, not toward the private sector. It is up to each company to create a cyber defense strategy.
Define and protect the “crown jewels.” Companies can’t afford to defend every aspect of the organization. As such, it is wise to develop a minimalist strategy that foremost protects the sources of competitive advantage.
Don’t wait for the “big event.” Most frequently, companies are not crippled by one significant event, but instead a “death of one thousand cuts”—a slow creep of proprietary information.
Incorporate the general counsel. At most organizations, the role of the CIO is to keep the company running and costs down, and therefore the CIO may not be the best choice to be responsible for cyber risk management. At American Express, for example, the general counsel has a key role in cyber risk management.
Spend intelligently. You can spend the entire company’s budget on cyber defense and still not know if the company is truly secure. The company should develop a defense strategy first, and then purchase the necessary supporting technology.
Ask the right questions. At the next board meeting, directors should ask: “Have we been breached?” Then, “what forensics team have we brought in to look at these threats?” Most likely, directors will require outside expertise to aid in the understanding of cyber risks.
Technology risk oversight is an area that will require more dedicated effort in the future. As such, NACD will continue to raise the discussion with white papers at upcoming educational events and in our NACD Directorship 2020 initiative.
Dennis T. Whalen, partner in charge and executive director at KPMG, led the final plenary session of the NACD Board Leadership Conference. He began the session by referencing Leo Abruzzese’s remarks during yesterday’s session, noting that it set the stage for this panel. Titled Leadership in a Complex and Changing Global Arena, the panel explored how boards oversee operations in a tightly connected global marketplace.
Dr. Ronald Sugar, director of Chevron and Apple, noted that all corporations are global to one extent or another, whether a company has global competitors, customers, or operations. “What global means for one company isn’t the same for another,” he said. Opportunities for growth are increasingly outside of the United States, and with these opportunities come a new dimension of enterprise risk. To help mitigate this risk, companies should consider having directors who live overseas, run a company overseas, or has some other international expertise.
While the focus on international markets tends to shine the spotlight on China and India, the Hon. Paula Stern, director of Avon Products, said the focus on these markets has overshadowed other exciting opportunities. One such example is Africa, with countries that are rich in resources. “Africa is no longer this continent we can ignore,” she said. Stern cautioned that it’s important for directors to examine the rule of law and political stability of any country a company is considering doing business in. She also added that when looking for a suitable market for your company, one indicator of potential is a rising middle class.
As a company prepares to move overseas, Karen N. Horn, lead director of Eli Lilly, noted the right business strategy, tone at the top, and robust backup systems all need to be in place. She said a company needs someone who listens to the market or knows the market to find good partners or places to find employees. Stern added that talent is another aspect. “Your talent has to reflect that tone [at the top] every day in the marketplace,” she said.
One of the challenges companies face as they expand into overseas markets is ensuring board some board members have international experience. While larger companies have an easier time with recruiting such directors, smaller companies may have to explore other options for getting this experience. Horn suggested one way to get international experience is to also consider offering advisory roles. Stern noted that she had the experience of sitting on the international board of a French company. This company has a separate international advisory board that convenes twice a year, and top managers are available during those meetings. “It helps get past logistical and practical problem of finding international board members,” she explained.
One of the popular questions that the presidential candidates repeatedly ask is “Are we better off today than we were four years ago?” In the Forecasting the Economic Climate session, Leo Abruzzese, global forecasting director for the Economist Intelligence Unit, referenced the same question in his remarks about the U.S. economic outlook, but he also offered some answers.
Four years ago, the United States was at the beginning of the worst six months it had faced in seven years. The economy was shrinking by 4 percent, and it got worse in the first quarter of 2009. In 2012, the United States economy will probably grow by 2 percent this year. By that standard, Abruzzese noted that we are certainly better off, but that 2 percent is “nothing to write home about.” In past years, the economy typically grew by 3 to 4 percent. “The truth is we’re all underperforming right now [the United States, Europe, etc.].”
Abruzzese then turned his focus on offering an outlook on risks and opportunities for next two years. He noted that we are currently in a “dangerous phase.” The global economy is composed of three engines: The United States, which is still the largest economy in world, the European Union, which is about same size as the United States economically, and China. None of those three engines are performing as well as they should, he said. Europe is in a recession, so there is little growth and China isn’t doing as well as usual. China’s economy is growing 7.5 percent, but they are accustomed to growing by 9 to 10 percent.
Four years after the recession, the United States is working on stimulating the economy. The Federal Reserve is turning on the printing press again and printing half a trillion dollars over next year to get the economy going. And it’s not just in the United States; central banks in other countries are trying to stimulate the economy. All this means a couple trillion dollars are going to hit global economy in next 12 to 18 months.
Outlook for 2013
Abruzzese suggested that 2013 most likely won’t be better than 2012 because the financial recession is not a normal business cycle recession and takes years to work through. 2013 will be filled with slow, uneven growth, high unemployment, and less government spending. Additionally, emerging markets will see less export demand. Abruzzese noted that the employment rate has a strong impact on the economy. Seventy percent of what happens in U.S. economy is consumers spending. If they don’t have jobs, they aren’t buying, he explained.
However, in 2014 he suggested the environment will begin to improve.
Looming Fiscal Cliff
The much hyped fiscal cliff is expected to hit in January. Abruzzese says that the worst will not materialize, noting that if it does, it would push us back into a recession. “As dysfunctional as the political system is in United States, whoever controls government won’t let this happen.”
China 2013 Forecast
As noted above, China’s growth has slowed. However, Abruzzese noted they are throwing fuel on the fire to stimulate the economy and beginning to see evidence it’s working. Also in play is the fact that China is becoming more of a consumer, which is good news for every other country interested in selling to them. China has already matched the United States in retail sales.
In 2007, 10 U.S. companies were in the world’s 20 largest companies by market cap. Despite the recession and slow recovery, as of last month, there were 14 U.S. companies on the list. “As long as most of the best companies in the world are still based in the United States, it gives us a reason to be optimistic,” Abruzzese said.