It should come as no surprise that security has moved from an afterthought at global organizations to a front-and-center consideration, often involving the CEO and board of directors. Headlines of the world’s largest companies involved in breaches are rampant, and will only increase as organizations accelerate their digital transformation plans and in doing so create lucrative opportunities for bad actors to steal valuable assets. Businesses are inherently interested in making money, and cybersecurity crimes have a significant impact on their bottom line. In fact, it is estimated that cybercrime will cost $2.1 trillion by 2019, according to Juniper Research.
For C-level execs and board members alike, their real understanding of cyber-exposure is too often binary: Are we on the front page of the Wall St. Journal or Not? While this may be an unfair over-generalization for tech-savvy board members, it is clear that cybersecurity is now included in their “fiduciary duties.” With increasing investments going to security software, consultants, and now cyber-insurance, executives and officers must know the risk profile of their digital systems and security service level agreements (SSLAs).
Organizations looking to maintain their competitive edge will take a new approach to security from the first line defenders in the IT department to the boardroom. The quickest and simplest step in moving the right direction must be to answer “How secure are we as an organization?”
The Best Defense is a Good Offense
Forward thinking organizations are appointing board members that have recognized this security paradigm shift and are moving from a defensive to an offensive mindset when it comes to protecting their assets. Some companies, like AIG, Blackberry, General Motors and Wells Fargo are even going so far as to appoint board members with cybersecurity expertise. While it isn’t mandatory that organizations have cybersecurity experts on their boards, the reality is that no board can escape responsibility, and digital threats will only become more a part of daily business life.
Ask the Right Questions
Beyond asking “How secure are we?” board members should ask their CISOs and security professionals whether their resources and budgets are appropriate. While CISOs will likely always ask for more, they need to be able to demonstrate specific holes and needs or anticipate pending regulatory changes specific to their industries. It would also be wise to regularly ask what internal changes have been made in light of developments in the industry. Additional questions that should be asked include:
- How are you designing a security posture that does not slow down business operations?
- How do we know that data/IP systems not in our control are safe and secure, such as internet of things (IoT) and cloud?
- How do we ensure that we are ahead of new regulatory requirements coming down the pike?
- Who is responsible for security—CISO, CIO or risk & compliance officer?
- What is our risk score matrix?
Establish a Seat at the Table
For CISOs, this new attention can be a double-edged sword; while the increased visibility of their position could be beneficial to their own importance to the company, their performance will be scrutinized by the highest levels of management.
CISOs and their security equivalents presenting to the board require a persistent seat at the table. Bringing them in just for an annual report will leave many questions unanswered and does not paint an accurate picture of the organization’s risk profile. Continual updates should include both positive and negative developments, which will make budget increase requests more likely when needed.
These experts should also be expected to provide detailed analytics and a tailored executive dashboard that demonstrates the progress made against goals and benchmarks. The sophistication of these dashboards will depend on the board’s expertise but educating these members should be included in any presentation.
Put a Price on it
When taking these steps and bringing security to the forefront of business planning, each board presentation will allow organizations to make security a marketable attribute. Consumers are becoming increasingly fickle about doing business with organizations that have been breached and as a result are looking for assurance that they and their data will be secured. Promoting your organization’s commitment to security can be a valuable asset to the company’s bottom line. Board members can play a significant role in shifting perception and reality in the marketplace and would be wise to ask more questions to get closer to answering “How secure are we?”