Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
Cybersecurity In-Depth: Feature articles on security strategy, latest trends, and people to know.
Top 3 Priorities for CISOs in 2024
A changing regulatory and enforcement environment means the smart CISO might need to shift how they work this year.
Stephen Lawton, Contributing Writer
January 19, 2024
5 Min Read
Source: Panther Media GmbH via Alamy Stock Photo
As the new year begins, CISOs gather with their security teams and corporate management to scope out top priorities for 2024 and how to address them. This year — with a multitude of new privacy laws, Securities and Exchange Commission (SEC) regulations, cyber threats, and new technologies promising to solve those threats — they might be losing sleep trying to optimally stack the proverbial Tetris pieces of the cybersecurity strategy.
Of all the challenges vying for the CISO's attention, the personal and legal responsibility for data breaches the SEC has placed on CISOs could be the most challenging in the new year, says Nicole Sundin, chief product officer at Axio.
"With CISOs being elevated to the boardroom to discuss these risks, they will need a system of record to protect themselves and demonstrate duty of care," she notes. "Currently, CISOs have these conversations, make difficult choices, and act as they see necessary — but these may or may not be documented. By having a single source of truth or a system of record, CISOs can better protect themselves."
Those who don't keep a record of events and why they were taken will be the ones who "take the fall," Sundin adds.
1. Defend Yourself Against Personal Liability
Sundin likens CISOs to healthcare executives, who keep detailed records of every action they take in order to defend themselves against claims of malfeasance. Considering that many CISOs are not covered under corporate directors and officers (D&O) insurance policies, they would be liable personally under new SEC rules should a breach occur. That includes personal liability for both a breach with data loss or a privacy breach without data loss.
Sundin recommends that CISOs take the following steps as soon as possible:
Create a system record. It can be a planner or diary where every action relating to a potential security incident is recorded with a detailed, chronological description of each action taken and the reasons why they were taken.
Create a corporate definition for "materiality." Be sure to get input from the general counsel or the chief risk officer to establish clear guidelines for what is legally considered materially significant to investors or shareholders and what is not.
Learn to speak to the board of directors and other executives in financial terms. Tell the board exactly which security controls are required, their cost, and the potential loss to the company if a breach occurs due to not having the security controls in place.
CISOs must also be active participants when negotiating cyber insurance policies, Sundin says. Typically CISOs need to sign off on what the general counsel or CFO ultimately negotiates, but without having direct input — with a written record of their recommendations — they could become legally liable for protecting a non-insurable exclusion.
2. Monitor Emerging Privacy Threats
Cyber insurers will focus on privacy breaches in 2024, predicts David Anderson, vice president of cyber liability at Woodruff Sawyer, a national insurance brokerage. Anderson says cyber insurance underwriters are expected to harden regulations on how organizations implement security on private data and privileged accounts, including service accounts, which he notes tend to be overprivileged and often have not had their passwords changed in years.
Citing the tightening privacy laws in states such as California and Washington, he says cyber insurers are demanding organizations not only have comprehensive privacy policies in place, but be able demonstrate that they follow their policies. If organizations fail to protect data protected by their privacy policies, they could find themselves without the coverage.
"It might be an uninsurable risk. Those claims are horrifically expensive from a defense and settlement perspective," Anderson says. "The underwriter is going to look for more than just a yes or no checkbox [on a cyber insurance application]. You are going to have to show where these controls are embedded [and] where you're forcing your vendors to adhere to the same level of care" as your organization's privacy policies dictate.
3. Manage Third-Party Risks
While privacy threats will be high on board of directors' priorities for 2024 thanks to the new SEC regulations and cyber insurers' requirements, so too will other supply-chain threats. Alastair Parr, senior vice president of global products and services at third-party risk management (TPRM) provider Prevalent, says organizations should build their procurement programs by identifying partners from the perspective of: How can this third party offer operational resilience benefits to us?
Forward-thinking visionaries look at TPRM and data in the aggregate and what data breaches mean based on emerging and expanding regulatory compliance, Parr says. Rather than focusing on the data itself, he suggests taking a holistic approach, calling it a cross-functional supplier risk management framework.
"As soon as the board starts thinking about it as cross functional, as a more comprehensive program — more of a life cycle — that changes the questions they should be asking," he says. "They should be getting excited about the procurement involvement. They shouldn't be scared of data for data's sake."
The vast majority of companies today are struggling with TPRM, Parr says, because they focus more on the cost of data governance than on regulatory compliance, operational resilience, brand impact, or the reputational risk associated with data breaches.
In the environment of increased regulation, CISOs are now held personally liable for data breaches, regardless of whether they involve data loss or privacy violations. In response, cyber insurance underwriters are tightening their rules on how organizations should protect private data and privileged accounts. And all of this is happening with increased attention from regulators, insurers, and the C-suite to supply chain threats.
To meet these challenges in the coming year, CISOs need to protect their organization and themselves by creating a system to document relevant actions and decisions, establishing and enforcing comprehensive and consistent privacy policies, and assessing their third-party partners in terms of operational resilience.
By working across the organization with procurement, legal, and security teams, CISOs can mitigate the potential impact of supply chain threats and insurance costs on their businesses — and cover themselves too.
About the Author(s)
Stephen Lawton is a veteran journalist and cybersecurity subject matter expert who has been covering cybersecurity and business continuity for more than 30 years. He was named a Global Top 25 Data Expert for 2023 and a Global Top 20 Cybersecurity Expert for 2022. Stephen spent more than a decade with SC Magazine/SC Media/CyberRisk Alliance, where he served as editorial director of the content lab. Earlier he was chief editor for several national and regional award-winning publications, including MicroTimes and Digital News & Review. Stephen is the founder and senior consultant of the media and technology firm AFAB Consulting LLC. You can reach him at [email protected].
You May Also Like
Your Everywhere Security guide: Four steps to stop cyberattacksFeb 27, 2024
Your Everywhere Security Guide: 4 Steps to Stop CyberattacksFeb 27, 2024
API Security: Protecting Your Application's Attack SurfaceFeb 29, 2024
API Security: Protecting Your Application's Attack SurfaceFeb 29, 2024
Securing the Software Development Life Cycle from Start to FinishMar 06, 2024
Latest Articles in The Edge
Library Cyber Defenses Are Falling DownFeb 20, 2024|3 Min Read
Enterprises Worry End Users Will Be the Cause of Next Major BreachFeb 16, 2024|2 Min Read
10 Security Metrics Categories CISOs Should Present to the BoardFeb 14, 2024|6 Min Read
How Changes in State CIO Priorities for 2024 Apply to API SecurityFeb 12, 2024|4 Min Read