The Security Interviews: How Crest is remaking the future of consultancy

A decade of growth

Since it was founded, Crest has grown from a small UK-centric non-profit to a globe-spanning organisation with just under 200 member companies at worldwide, regional or country level.

“The way it operates is that we accredit those organisations looking at their policies, processes and procedures,” says Glover. “We do on-site audits, we do technical assessments where appropriate, and we can run those in any parts of the world. And we accredit companies in penetration testing, cyber security, incident response, vulnerability analysis, threat intelligence, and we also accredit SOCs [Security Operations Centres].

“This is through a combination of paper-based audit, on-site audit and technical assessment, so it’s quite a high bar and we still have more applications in process than we have members. It’s quite a difficult thing for organisations to reach.”

Crest claims its accreditations are becoming increasingly sought after in the buying community – particularly in the US, where it says a growing number of security services specialists are regularly asked whether they are a Crest member when tendering for a job.

Glover puts this down to the growing size and complexity of the security market. “Security services are difficult things to buy,” he says. “How exactly do you go out and buy a pen test if you’ve not done if before? How do you know the SOC service you’re contracting into is good, bad or indifferent? That’s not an easy thing for a traditional procurement programme to actually identify – we’re doing the heavy lifting on behalf of the buying community, and we’re also setting good practice.”

From advice to opinion

Now that the security marketplace has grown significantly and security services providers have gone from boutique outfits to big-name brands, this need is becoming greater than ever, says Glover. He adds that buyers are now realising that if they contract their security services to structured organisations that back up their technology claims with certified skills and best practice, they get better outcomes.

He also reckons that security consultancy will soon begin to move from an advisory-based practice to an opinion-based practice. “We haven’t really done that as an industry yet, but I absolutely believe that is the direction of play,” he says.

But what does that actually mean? Glover explains: “Right now, we provide advice and guidance. We look at your systems and we say ‘that’s not very good – you should correct it’. That’s advice. But what we’re now seeing under GDPR [General Data Protection Regulation] and other regulations is you are asked if you have taken appropriate steps to secure your data, otherwise the regulator is going to take regulatory action or fine you a lot of money.

“So we are now moving into this area where security consultants have to be professional auditors and say, in our professional opinion, this organisation has or has not taken appropriate steps to secure its data. That is going to be a significant change in the security services market. We are well geared up to do it, but it won’t happen without some pain, and certainly a change of mindset among Crest members.”

This change of mindset will be necessary because, under this model, security consultants will find themselves under similar restrictions as they would if they provided other services where they give a professional opinion, such as financial audit.

There is a lot of risk and personal liability associated with this sort of activity, as Glover recalls from his time on the board of SEC, when he had to read and understand the reports put in front of him thoroughly, because signing them off made him personally liable. As regulation such as GDPR becomes more widespread, this is something CISOs may not yet have grasped.

“Education is needed to try to help security professionals understand the direction of play,” he says. “I don’t think it’s a big change from advisory to accountability, but it is a change and it will be a change for the organisation as much as the individuals, because that organisation will be liable for the advice and guidance it provides in that opinion-based service.”

Challenges ahead

But the way forward for this new model of security services will not be without its challenges, says Glover. “The model that we put forward in terms of trusted organisations with credentialed individuals tied together with effective codes of conduct sounds, in one sentence, a really easy thing to do, but in actual fact it is quite difficult to achieve. We’ve got to tidy things up.”

Many of these challenges will centre on legality and ethical behaviour – such as what constitutes a GDPR breach, or how to run simulated phishing attacks or penetration testing – areas where Glover says there are clearly some grey areas.

“Take disruptive methods, like crowdsourced bug bounty programmes,” he says. “We need to understand how those could operate within a regulated environment and we need to understand how we can control access to them.

“If you open your system up to a bug bounty programme, it’s very difficult to turn it off, so you need to do it at a particular point in maturity – you can’t do it too early. But if you don’t act on those observations that come through them, then where does that information go legitimately? That’s quite a difficult question to answer.”

Undoubtedly, adds Glover, getting it wrong in the case of a major data breach could see security professionals being legally sanctioned in the courts, so it is important that the certification process is watertight.

Crest’s process is already comparable, in terms of time needed to achieve it, to becoming a chartered accountant with the ICAEW – a three-year process if you train with a “Big Four” practice (Deloitte, EY, KPMG and PwC).

“Our qualifications come in at around 2,500 hours after a good degree, then it goes up to about 6,000 hours for our registered level and about 10,000 for our certified level,” says Glover.

“Our practitioners can work on these assignments with support, our registered-level can work without support but can’t sign off, and our certified-level people are operationally competent and can sign off. We’ve got about 4,000 people certified, and we’re building international relationships with other professional certification bodies on a global basis.”