Risk

3/3/2014
09:30 AM
50%
50%

How To Fund Enterprise Cybersecurity: CISO Tips

How do you ensure funding for enterprise cybersecurity? Help C suite execs understand the true nature of cyberattacks.

How do you get corporate funding for cybersecurity when it's so challenging to measure and report ROI to your C suite and board of directors?

This was one of the many topics discussed by chief information security officers on several panel sessions we attended last week at the RSA Conference in San Francisco.

During a session entitled "Aligning Cyber Security Personnel & Processes," Greg Schaffer, CISO of Circumference Group and a former Fidelity Investments CSO, summed up the dilemma this way: "The fact that you haven't had an incident is not an indication that you are secure. The fact that you have had an incident is not an indication that you're less secure."

How do you find the right metrics to report to your business-side executives? We can draw some lessons from the process outlined by Gary Gagnon, senior VP, CSO, and corporate director of cybersecurity for Mitre Corp. His team provides a monthly executive-level metric report featuring seven or eight briefing charts. He explained these charts and the information they show.

Read the rest of this article on Enterprise Efficiency.

Susan Nunziata leads the site's content team and contributors to guide topics, direct strategies, and pursue new ideas, all in the interest of sharing practicable insights with our community.Nunziata was most recently Director of Editorial for EnterpriseEfficiency.com, a UBM ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7682
PUBLISHED: 2018-06-22
Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains.
CVE-2018-12689
PUBLISHED: 2018-06-22
phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login panel.
CVE-2018-12538
PUBLISHED: 2018-06-22
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage...
CVE-2018-12684
PUBLISHED: 2018-06-22
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file.
CVE-2018-12687
PUBLISHED: 2018-06-22
tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h.