Building a culture of cyber security

Before 2010, threats of ransomware and malicious malware seldom, if ever, made the news headlines. But as more and more information moved to the cloud and digital technologies expanded, so did the frequency and sophistication of such cyber attacks. This shift prompted organizations and individuals to do more to protect the information they stored and transferred within these infrastructures.

Within Accenture, a small team was tasked with formulating a response, strengthening and expanding our security defenses beyond technical systems, tools and controls by restructuring our security approach to meet Information Security Management System (ISMS) standards. Such standards looked to manage cyber security with a focus on people, processes and technologies, and served to establish the framework to protect Accenture’s global and increasingly mobile workforce.

Further, the team also undertook a formal assessment process in 2011, designed to create a comprehensive Information Security Risk Profile for the company. This move helped identify and prioritize security risks, as well as the actions necessary to prevent and protect against them. These transformative steps led Accenture to formally create the company’s information security organization.

Now with over 50,000 physical and virtual servers operating our business and supporting our clients, the Information Security organization is more than 800 people strong across the globe. The team’s expertise spans technical architecture and security operations, governance and risk management, acquisition integration, threat response and intelligence, compliance and behavior change.

Given an environment of aggressively growing cyber threats, Accenture’s risk tolerance has changed. In response, the industrialized processes of our Information Security organization continue to prove value, most visibly through the overall culture of shared accountability that has developed across the company. Through our team’s fine-tuned programs and processes, every Accenture employee understands they each play a role in keeping Accenture and its clients secure.

One tangible way this understanding has manifested is in employee participation in the award-winning Information Security Advocates program. This program engages each person in bite-sized, “gamified” security training exercises each quarter. Learning experiences on topics like social engineering, credential theft and working remotely are modified and refreshed regularly as new threat realities are identified. This training—a lot of which is voluntary—has shown that with each completion employees are much less likely to be involved in a security incident. And, on average, 99% of all employees become Information Security Advocates each year.

Another valuable capability from the evolution of Information Security is the ISO-certified Client Data Protection (CDP) program. This program provides Accenture client engagement teams with a standardized approach to managing risk through a set of security processes, controls and metrics. A CDP plan is developed for each client project and provides end-to-end security risk management measures covering physical, application, infrastructure and data security.

A further valuable outcome is detailed reporting. Key security performance indicators (KPIs) from across the business are captured and fed into a comprehensive Security Posture Scorecard (SPS). The contents are used to report out to the highest levels of Accenture leadership weekly, and to the Board of Directors twice a year. The dozen-plus KPIs include measures such as vulnerabilities, out-of-compliance servers, and misconfigured networked devices. In reviewing the SPS, Information Security teams have a very near real-time view of the global security posture. This view gives them the ability to take corrective actions more proactively and plan strategically.

Our Information Security organization’s continuous flexibility through a constant state of change and our ability to reinforce a security mindset across a global workforce, demonstrates one Accenture that protects client and Accenture information.