The practice will focus on claims, coverage, and corporate law for the insurance world. “The Colombian insurance market has become a more attractive prospect since new legislation opened it up to foreign insurers in 2013,” said Alex Guillamont, head of the firm’s Latin American and Caribbean practice.

The Bogotá office of Kennedys Law will be led by Mónica Tocarruncho Mantilla and Andrea Londoño Agudelo, both of whom have significant experience in the nation’s insurance sector. “In Mónica and Andrea we have recruited two of the best insurance lawyers in Colombia to set up what I am sure will quickly become one of the leading specialist practices in the country,” said Guillamont.

Before joining Kennedys Law, Tocarruncho was general counsel at Royal and Sun Alliance Colombia (RSA), where she oversaw the firm’s local acquisition by Suramericana. Londoño previously served as the head of DLA Piper Martínez Neira’s Colombian insurance law practice. She has also worked with insurance broker giant Aon in London.

In addition to its Bogotá office, the company also announced an expansion in Chile. “These latest office openings further reinforce our strategy to establish a presence in key Latin American jurisdictions,” said Nick Thomas, senior partner at Kennedys Law. “They complement our well-established Latin America hub in Miami by providing on-the-ground expertise.”

2015 saw threats continuing to evolve faster than most organizations’ ability to detect and respond to them. What was considered an “advanced” threat in years past has become a commodity today with sophisticated malware and exploits available for the price of a movie ticket.  As troublesome as these observations seem, the most impactful evolution goes almost entirely unreported and misunderstood.  The threats that matter most, today’s pervasive threat actors execute attack campaigns comprised of multiple compromise methods and multiple backdoors to assure persistence. Incomplete incident scoping has become a critical failure point.

We’re starting to see progress in some areas as security investments begin to shift from a maniacal focus on prevention, toward greater balance on monitoring, detection, and response capabilities.  It’s become cliché to say that breaches are inevitable and that faster detection and more accurate incident scoping is the way forward, but too many organizations are trying to do these very different tasks using the technologies and processes they have on hand…not designed nor capable of answering their need. Here are some of the emerging trends that our industry and organizations need to be ready for in 2016:

RSA’s Amit Yoran says: “Foolish investments have been made in strategies and technologies that are little more than snake oil.”

1. Strategic Data Manipulation and Disruption – Organizations will begin to realize that not only is their data being accessed inappropriately, but that it is being tampered with. Data drives decision making for people and computer systems. When that data is unknowingly manipulated, those decisions will be made based on false data.  Consider the potentially devastating consequences of misrepresented data on the mixing of compounds, control systems, and manufacturing processes.
2. Increasing Attacks on Application Service Providers – As organizations become more comfortable with the “as a Service” model, many of their most sensitive applications and data reside in the Cloud. The aggregation of this valuable data from many companies creates an incredibly lucrative target for cybercriminals and cyber espionage. A deeper appreciation of third party risk is needed.
3. Hacktivism and the Attack Surface – Per my earlier comment, as cyber-attack tools and services become increasingly commoditized; the cost of attacking an organization is dropping dramatically, enabling more attacks that do not have financial gain as the primary focus. Sophisticated hacktivist collectives like Anonymous have been joined by relatively unsophisticated cyber vigilantes.  Organizations need to realize that financial gain is no longer the only or even the biggest driver of some of their adversaries.  Security operations and risk managers should evolve their understanding not only of the threat, but also of what, why, where, and how they are being targeted.
4. ICS (Industrial Control Systems) pushed to the Breaking Point – Intrusions into systems that control operations in the chemical, electrical, water, and transport sectors have increased 17-fold over the last three years. The advent of connected and automated sensors with the IoT aggressively exacerbates these issues. The growth in the use of cyber technology for terrorism, hacktivists and other actors, combined with the weakness of ICS security generally, combined with the potential impact of bringing down a power grid or water treatment plant (hello, California), makes the critical breach of an ICS in 2016 extremely concerning and increasingly likely.
5. Shake-out of the Security Industry – Our industry has been awash in venture capital and as a result, foolish investments have been made in strategies and technologies that are little more than snake oil.  As organizations’ security programs continue to mature, they are learning that claims of being able to prevent advanced threat breaches are nothing more than fantasy.  Expect to see a shake-out in the security industry as organizations maturing understanding of advanced threats increasingly drives their security investment decisions.

This is a guest contribution by RSA’s Amit Yoran. RSA is a division of EMC Corporation

• Nearly 75% surveyed lack the maturity to address cybersecurity risks
• 83% of large organizations ranked themselves as below “developed” in maturity
• Up to 45% admit inability to measure, assess and mitigate cybersecurity risk
• The most mature capability revealed in research is in the area of Protection, Detect and Response capabilities lag
• Only one-third of financial services organizations report being adequately prepared

• NIST Cybersecurity Framework used as the measuring stick; yet the Americas rank themselves behind both APJ and EMEA in overall maturity

The lack of overall maturity is not surprising as many organizations surveyed reported security incidents that resulted in loss or damage to their operations over the past 12 months. The most mature capability revealed in the research was the area of Protection. The research results provide quantitative insight that organizations’ most mature area of their cybersecurity program and capabilities are in preventative solutions despite the common understanding that preventative strategies and solutions alone are insufficient in the face of more advanced attacks. Further, the greatest weakness of the organizations surveyed is the ability to measure, assess and mitigate cybersecurity risk with 45% of those surveyed describing their capabilities in this area as “non-existent,” or “ad hoc,” and only 21% reporting that they are mature in this domain. This shortfall makes it difficult or impossible to prioritize security activity and investment, a foundational activity for any organization looking to improve their security capabilities today.

“This research demonstrates that enterprises continue to pour vast amounts of money into next generation firewalls, anti-virus, and advanced malware protection in the hopes of stopping advanced threats. Despite investment in these areas, however, even the biggest organizations still feel unprepared for the threats they are facing,” said Amit Yoran, the president of RSA. “We believe this dichotomy is a result of the failure of today’s prevention-based security models to address the advancing threat landscape. We need to change the way we think about security and that starts by acknowledging that prevention alone is a failed strategy and more attention needs to be spent on strategy based on detection and response.”

Counter to expectations, the research indicates that the size of an organization is not an indicator of maturity. In fact, 83% of organizations surveyed with more than 10,000+ employees rated their capabilities as less than “developed” in overall maturity. This result suggests that large organizations’ overall experience and visibility into advanced threats dictate the need for greater maturity than their current standing. Large organizations’ weak self-assessed maturity ratings indicate their understanding of the need to move to detect and response solutions and strategies for a more robust and mature security.

Inaugural Cybersecurity Poverty Index Shows A Troubling Lack Of Maturity And An Over-reliance On Prevention

Also counterintuitive to expectations were the results from financial services organizations, a sector often cited as industry-leading in terms of security maturity. Despite conventional wisdom, however, the financial services organizations surveyed did not rank themselves as the most mature industry, with only one third rating as well-prepared. Critical infrastructure operators, the original target audience for the CSF, will need to make significant steps forward in their current levels of maturity. Organizations in the Telecommunications industry reported the highest level of maturity with 50% of respondents having developed or advantaged capabilities, while Government ranked last across industries in the survey, with only 18% of respondents ranking as developed or advantaged. The lower self-assessments of maturity in otherwise notably mature industries suggest a greater understanding of the advanced threat landscape and their need to build more mature capabilities to match it.

Despite the fact that the CSF was developed in the United States, the reported maturity of organizations in the Americas ranked behind both APJ and EMEA. Organizations in APJ reported the most mature security strategies with 39% ranked as developed or advantaged in overall maturity while only 26% of organizations in EMEA and 24% of organizations in the Americas rated as developed or advantaged.

Methodology

To assess cybersecurity maturity, respondents self-assessed their capabilities against a sampling of the NIST Cybersecurity Framework (CSF). The CSF provides guidance based on existing standards, guidelines, and practices for reducing cyber risks, and was created through collaboration between industry and government. While the CSF was initially developed in the United States with the aim of helping to reduce cyber risks to critical infrastructure, organizations worldwide have found it to be a prioritized, flexible, repeatable, and cost-effective approach for managing cyber risk. Thus, it serves as an excellent baseline to assess any organization’s core cyber security and cyber risk management maturity.

Organizations rated their own capabilities in the five key functions outlined by the CSF: Identify, Protect, Detect, Respond, and Recover. Ratings used a 5 point scale, with 1 signifying that the organization had no capability in a given area, and 5 indicating that they had highly mature practices in the area.

Praxis opened with a strategy of establishing a strong presence in their 14 specialty service areas, bringing their customized “Software Factory” to Colombian customers; and also their specialized Capability Maturity Model Integration methodology, which according to the firm, is a way of analyzing and evaluating business processes of customers to improve operations.

Praxis has obtained CMMI Level 5 certification, adopting AGILE software development methodologies, and RCP &REP certification from the PMI (Project Management Institute). The 15 year old firm has a service offering in Mexico, the United States, Brasil, Puerto Rico, Argentina, Central America, Chile, Perú, and Spain; as well as representatives and sales offices throughout the Americas, the Middle East, Russia, Asia, and the Pacific.

FINANCE COLOMBIA: Speaking of the financial sector, what is the opportunity that Praxis sees here in Colombia with the banking sector, the insurance sector, the securities sector?

Chiquillo: The opportunity that we have detected here relates to quality; quality and testing. That is something that here has been a bit unattended. When we started to research the market and spoke to people in the industry, everybody had software development capabilities. But we noticed they didn’t have quality assurance suppliers, facilities for testing, something really important. It appeared to us as a flaw because in terms of method: if someone is developing, they should test too. The person who creates your systems must take care of them, control them, they are in charge. The testing team should be completely independent, where they assess the quality of what is given to you as two different teams. We have found a couple of banks who have quality teams that are working well, and with good methods. In Praxis when we spoke to them we started offering coaching and mentoring services in ISQB, the quality standard in testing, and in TMMI, the equivalent of CMMI. That was the main idea.

Finance Colombia: Praxis has stability; it has a presence in several countries, but what next? You are in Colombia, also in Mexico and other countries, fighting against ‘elephants’ such as Infosys and TCS. What is the difference between Praxis and the competition? Because the giants are big in the region and they can go to a client and say: “yes, we are here, we are worldwide and have the size to do what you need done.” Praxis is by no means a startup, but how do you face and compete with those global giants?

Chiquillo: There is something complicated in the Colombian market, I have to tell you. Those “elephants” came with really low prices. If I am to be honest, at this moment, our competition strategy is not price. We try to level up or bring it a bit higher. As you put it, the difference between being big and being gigantic, that’s the most significant thing. We have three main strategies: 1. We have to level up. What are we doing? This year is an acquisition year. We are investing in the Caribbean, which has very good universities, the education has improved, and there are good development resources, much cheaper, in order to compete. Nevertheless, that is not our main purpose at Praxis, we do not compete on prices, we compete on quality. We have certification as a super company; we have been awarded that ever since 2008, every year as being a “Best place to work.” Our professionals enjoy working here; our specialties are well distributed to attend to the different aspects of our clients’ business, so at this moment what we offer is service and quality. That is the factor that differentiates us; our financial clients are happy, they have no problems and have a long, ongoing relationship. When we replicate the model in a new country—it’s been a year and a half here in Colombia—it happens to be much easier.

Finance Colombia: That is because your clients told you: “Look, we want your presence in Colombia because we have operations there”—or how did it happen?

Chiquillo: Praxis started as a small company, it kept growing, and now our objective is to work anywhere in the same way. When we started the expansion project, that was the first thing we saw: we have to manage global accounts, and this financial service sector is very global. We have to take possession of it. So that was the starting point, although not the main objective. In the end, we decided that was the way we wanted to handle Praxis Global. Currently we are developing India, New York, London and have representatives in Israel and Australia, for instance. We reached a point where we want to attack at a global level, fully global. Banking strategy is the same. We want to tell them: “You opened operations in Mexico, we are also in Mexico and can help you in the same way.”

Finance Colombia: Apart from banks, and speaking of security and regulation, governance; if we see the insurance sector and stock exchange, what are the specific challenges?

Chiquillo: If we want to be specific, we offer them security. We approached the security issue with two main aspects, products and consultancy. In product we try to reach authentication systems, filtering and control. What does “authentication” mean? To give them all those things you mentioned, e-mail systems, two factor authentication…So we have products, integration and consultancy. Over 10 years of experience so, regardless of the organization, when they need double security—beyond a password—we implement all those services for critical data.

“We reached a point where we want to attack at a global level, fully global.”

Our bet is not to compete with the services of the giants, but to give clients a version of cloud based software development, of strong authentication where they do not have that high level of investment. We charge per user, we provide software-as-a-service, they connect to the cloud, and all those authentication services run through us. Likewise we do it with SOX (Sarbanes Oxley Act) Compliance.

Mail is filtered so that everything is real. We don’t want spammers or malware; we want the data to be real. We are at that level; Security Control and coaching as a product. Protocol management, security control, virtual courses and training sessions for all organizations, telling them, “These are the security mechanisms in organizations worldwide,” to avoid personal hacking, phishing, apart from control and analysis, to say: “please don’t use personal data in your passwords.” We are also working on that.

“Human talent is really good; the students come out well prepared from the universities.”

And consultancy is secular financial management, we attend to what the Colombian government tells financial entities they have to comply with, in order to attack those concerns first in terms of security, for instance in one case it was a requirement for a strong authentication network, so we had to bring the banks into compliance last year. And now we continue with controlled hacking. Lots of ethical hacking, we want to certify our systems are safe.

So the thing we want to offer and work on mostly, is consultancy, ethical hacking, and all the services of control. We already have strong experience with the energy sector, there are companies where we have found the flaws through the use of our ethical hacking and fortunately, remediated them. The companies were pleased.

Finance Colombia: Yes, I imagine that here or in Mexico, in the US they are very worried. The energy network is so smart now, so controlled, that hackers are able to try and go for a power grid shutdown. They have to be worried about those aspects of their critical infrastructure.

Chiquillo: If we speak about Colombia, the government is really concerned—about everything.

Finance Colombia: It’s more than hacking down an electrical tower; rather a hacker sneaking in the system…They are hacking with a hammer. “I’m a hacker!”

Chiquillo: And then it appears on the news: “Electrical network hacked with a hammer.” The idea is education and consulting mainly. That’s what they need. That is, products…in one area what we are doing is developing easy products, the right fit for companies, and that secures them. Because, one of the greatest challenges of selling security is that, if a company is big, it will require protection, but inn each level [of company size], everybody needs to have access to secure platforms.

Finance Colombia: I believe that many businesses, small businesses are scared, and think “we cannot afford a consultancy which will cost a lot and require a big contract…” they know they need something but they are scared of the price tag.

Chiquillo: What do we do in those cases? We take risks, just like the example you just gave: A company who says “I need to protect myself, I cannot by the RSA solution used for strong authentication, which costs $120.000 USD, plus integrating my systems and so on,” so what we do is, ask: “How many users do you want?” “Two” (a small company); “which resources do you want to protect?” “These ones.” So we provide strong authentication for users and we charge them monthly, let’s say a crazy number, $3 USD. Two users, that’s it.

Finance Colombia: One thing I have seen that impresses me is the quality of talent that exists here in Colombia.

Chiquillo: I wanted to tell you that. Something really cool that has happened to us is that Mexico and Colombia are quite similar. Culturally and in terms of normal interaction between management and teams and so on. Ecuador, which is right next to us, is different, yes? Venezuela is quite different, almost another planet. And they are there on the border. But if you ask me, all the media we received here in Colombia since the 40s and 50s, was Mexican, from when TV arrived until the 90s more or less, when the Peruvians entered [the Colombian media market].

“We want our employees to feel well, to have time for everything, for their personal lives.” 

But I assure you that culturally, Colombia is very similar to Mexico, and it has helped our company work. You said it: you have seen in both Mexico and Colombia the level of innovation, of trying to give solutions instead of applying ready-made answers.

Human talent is really good; the students come out well prepared from the universities. I believe we are the sector who offers the best pay to recently graduated professionals. I think every day, how do I have to fight with [competitors] for a human resource, a good, recently graduated Java developer, to compete against all the giant firms. So what did we have to do? Good planning and development practices, work-life management. “Sir, you check in and have to work 8 hours. Arrive anytime you want, within reason do your eight hours. If you have to stay longer, then there is a planning and resource allocation problem. But it’s not your problem, it’s ours!

Finance Colombia: It is important to believe in having balance; as the saying goes “work-life-balance”, because otherwise, in most cases, somebody changes his or her job not only because of salary, but other reasons such as lifestyle and office pressure, “It leaves me no time to attend to my personal affairs, family, whatever.” Companies who have more balance in those aspects, will have more loyal employees. If it is pleasant, then I want to be at my office, with my co-workers, and producing, if it is a healthy, functional work environment.

Chiquillo: We want our employees to feel well, to have time for everything, for their personal lives. And it has gone well for us and attrition levels are low, even while everybody is looking to poach resources from us all the time.

Finance Colombia: It’s also better for clients, because they are working with the same team, with some tenure and stability, without people always coming and going.

Chiquillo: And with our financial clients that stability is really important.