By implementing the steps above, all organizations can make near-term progress toward improving cybersecurity and resilience. In addition, while recent cyber incidents have not been attributed to specific actors, CISA urges cybersecurity/IT personnel at every organization to review Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure. CISA also recommends organizations visit StopRansomware.gov, a centralized, whole-of-government webpage providing ransomware resources and alerts.
The C-Suite and IT Need to Get on the Same Page on Cybersecurity
In June, the Federal Bureau of Investigation and the U.S. Department of Justice informed reporters that they view the recent slew of ransomware attacks with the same level of perceived threat as the 9/11 terrorist attacks. This is a huge weight on the shoulders of security leaders who are trying to keep their organizations secure, even as hybrid and remote working environments spur data sprawl and increasingly leave organizations exposed to cyberattacks.
Proving the business value of your cybersecurity initiative is no small feat. Sometimes a helping hand from a trusted partner is exactly what you need to take care of the menial day-to-day tasks so you can focus on bigger picture strategy and campaign monitoring.
In the months before an unexpected crisis, IT security requests specific tools, training, and additional staff to keep enterprise data safe, but does not substantiate the need in terms the business can understand. The c-suite denies the requests, pointing to the investments they have already made in security technologies. Suddenly, hackers strike with a massive cyber attack.
Suffering financial losses and brand damage, the c-suite asks IT security what happened. Security responds that they need specific tools, training, and staff to mitigate these concerns. But again, security does not make a business case in language the c-suite can appreciate. The leadership turns to existing vendors, who sell them their latest security products.
Armed with products that do not address all the specific vulnerabilities the company has, the c-suite returns to other matters. Months later the enterprise falls prey to similar attacks. A cyber security communications break down has kept the enterprise moving through this same cycle for years. The answers to breaking out of that rut lie in fixing those communications.
Communicating from the bottom up, IT security must talk to the c-suite in terms of the effects of security-related decisions and resource allocations on the business; otherwise the message fades into the background. IT security needs to impress upon the c-suite the risks that certain resources will mitigate and the potential bleeding in financial losses that balanced, proper threat mitigation can avoid.
With IT security priorities in hand, the board and c-suite need to communicate to IT security that they will follow through with any needed training and the enforcement of open lines of communication with and support for information technology security throughout the organization.
Yes, roughly a half dozen tips, tools for the board, c-suite and for information technology security are a great start to get everyone on the same page with the real issues and the most effective solutions.
Cyber security is increasingly becoming a risk to business like any other risk that businesses have to mitigate. Investors have expressed concern and so to has the Security Exchange Commision. The market is signaling to companies a need to protect themselves against cyber threats.
Corporate boards must take steps to allocate the same level of oversight and scrutiny to cyber security that they do to financials. Additionally executive managers who answer to the board must understand how proper cyber security is critical to the success of the business.
Before boards can demand that the C-suite perform better in regards to cyber security, there needs to be some responsibility taken up first. Cyber security needs to be treated as a risk to the continuity of the business. In action this would be the board placing the responsibility of auditing the company for cyber security compliance and precautions into the hands of existing audit/risk committees. This is a start of course, for companies with more resources there should be a committee exclusively dedicated to cyber security lead by someone with expertise in cyber security. This committee would not just audit security technology but planning and processes as well. For example, the committee may look for: incident response plans, cyber insurance, insider threat program, vendor management programs, data flow charts, cyber security training plan, vulnerability reports, and much more.
In the end the board should be absolutely clear about what their responsibilities are when it comes to holding the corporate board accountable for developing a strong security program. CEOs are the main piece of the puzzle that must be cultivated in order to ensure the other executives are all on the same page when it comes to cyber security. The cyber threats will only grow in intensity which will prompt a stronger response from governments. Might as well be prepared now rather than later, when it may be too late.
Creating a proper strategy for measuring and communicating security metrics is crucial in these circumstances. Quantifying cyber risks from a financial aspect enables making well-informed, data-driven decisions. Cyber Risk Quantification (CRQ) makes it easier to understand the vulnerabilities in complying with cyber security standards and gets both cybersecurity professionals and C-suite executives on the same page.
We operate in an era whereby cyberthreats are constant for all business, every single minute of the day. Not only is their threat perpetual, they continue to evolve. In this climate, in order to protect day to day runnings of business, executive leaders need to play the role of not just members of the C-suite, but also be cybersecurity experts. Cybersecurity within the C-suite is heavily linked to two factors. Firstly, it relates to boardroom priorities concerning governance, particularly for respective stakeholders and compliance obligations. The second factor includes GDPR and the protection of client data. Whether the person is the CEO, CFO, COO or CMO, cybersecurity is a top concern for all of us.
RFA provides clients with IT service management, Risk Management and committee leadership and Compliant Cyber solutions that enables businesses to efficiently and effectively implement and manage their cybersecurity strategies within their own technological environments, whilst also complying with governance demands, stakeholder needs and GDPR obligations. Reach out to me to chat, I am happy to help.
Marketing to the cybersecurity pros will come naturally. What may not come naturally for you is educating the C-suite on how security software can pay off in the long run. Work on creating the content that speaks to the people you need to sell on the idea. Think of the cybersecurity experts at the company as a partner in your sales process, and give them the tools to help convince their executives of the severity and ROI of the software.
Companies that are prepared for trouble often find out that they experience less of it because when everyone is on the same page for safety and security, employees are much more likely to notice problems before they grow into disasters. Negligent employees create over 60% of security incidents.
In 2021, we have witnessed how ransomware can have a crippling effect on the business, resulting in far-reaching impacts to the economy. Recent ransomware attacks that reached national headlines, such as the water treatment plant incident in Florida and the Colonial Pipeline attack, are just a couple of examples. Executives need to be on the same page about how the business will handle and respond to these different compromises, before a breach occurs.
Our interview data presents some of the main challenges of cybersecurity capability development at hospitals. Our model also provides an explanatory platform to analyze the complexities development of cybersecurity capabilities in hospitals. For instance, cybersecurity experts believe that resource utilization correlates strongly with infrastructure age: with the increasing arrival of security patches to a hospital IT department, the number of patches increases with the age of systems. These patches need to be tested for their impacts on internal systems, which is a losing endless loop of resource burden. This mechanism can be explained by the general feedback loop B1 in the model, where with the aging systems at a hospital, the cybersecurity level decreases, which in turn requires resources to build capabilities to fill out the cybersecurity gaps.
The Framework can be used by organizations that already have extensive cybersecurity programs, as well as by those just beginning to think about putting cybersecurity management programs in place. The same general approach works for any organization, although the way in which they make use of the Framework will differ depending on their current state and priorities.
A Framework Profile ("Profile") represents the cybersecurity outcomes based on business needs that an organization has selected from the Framework Categories and Subcategories. The Profile can be characterized as the alignment of standards, guidelines, and practices to the Framework Core in a particular implementation scenario. Profiles can be used to identify opportunities for improving cybersecurity posture by comparing a "Current" Profile (the "as is" state) with a "Target" Profile (the "to be" state). To develop a Profile, an organization can review all of the Categories and Subcategories and, based on business drivers and a risk assessment, determine which are most important. They can also add Categories and Subcategories as needed to address the organization's risks. The Current Profile can then be used to support prioritization and measurement of progress toward the Target Profile, while factoring in other business needs including cost-effectiveness and innovation. Profiles can be used to conduct self-assessments and communicate within an organization or between organizations. 2ff7e9595c
Comments