Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

5/29/2018
09:35 AM
Steve Durbin
Steve Durbin
News Analysis-Security Now
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Cybersecurity & C-Suite: Why Executives Should Take the Lead

Enterprises of all sizes need to be cyber resilient, but who should take the lead? Here's why the whole C-Suite needs to get more involved in the fight against cyberattacks - both inside and out.

The pace and scale of information security threats continues to accelerate, endangering the integrity and reputation of today's most trusted organizations. Businesses are struggling to cope with the quantum speed and sophistication of global cyberattacks being carried out by organized cybercriminal syndicates.

Moving forward, businesses need to prepare to be targeted at any time, and any place, by multiple assailants. (See Equifax Taps Former Home Depot Security Chief as New CISO.)

Organizations that wish to keep pace with these developments, and remain financially viable, need to take action now, or face the consequences. With the speed and complexity of the security threat landscape changing on a daily basis, those organizations that don't prepare will be left behind in the wake of reputational and financial damage.

Reducing the attack risk
Today, risk management largely focuses on achieving security through the management and control of known risks.

(Source: iStock)
(Source: iStock)

The rapid evolution of opportunities and risks in cyberspace is outpacing this approach and it no longer provides the required protection. Cyber resilience requires recognition that organizations must prepare now to deal with severe impacts from cyber threats that are impossible to predict.

Organizations must extend risk management to include risk resilience, in order to manage, respond and mitigate any negative impacts of cyberspace activity.

Cyber resilience also requires that organizations have the agility to prevent, detect and respond quickly and effectively, not just to incidents, but also to the consequences of the incidents.

This means assembling multidisciplinary teams from businesses and functions across the organization, and beyond, to develop and test plans for when breaches and attacks occur. This team should be able to respond quickly to an incident by communicating with all parts of the organization, individuals who might have been compromised, shareholders, regulators and other stakeholders who might be affected.

Cyber resilience is all about ensuring the sustainability and success of an organization, even when it has been subjected to the almost inescapable attack.

By adopting a realistic, broad-based, collaborative approach to cyber security and resilience, government departments, regulators, senior business managers and information security professionals will be better able to understand the true nature of cyber threats and respond quickly and appropriately.

The need for security standards
Business leaders recognize the enormous benefits of cyberspace and how the Internet greatly increases innovation, collaboration, productivity, competitiveness and engagement with customers.

Unfortunately, these executives have difficulty assessing the risks versus the rewards. One thing that organizations must do is ensure they have standard security measures in place.

In preparation for making your organization more cyber resilient, here is a list of next steps that I believe businesses should implement to better prepare themselves:

  • Focus on the Basics: This includes looking at people and technology, and adopting policies and procedures to engage the business' security concerns.
  • Adopt Policies and Procedures to Engage: Businesses need to prepare for the future, as well as be ready to support new initiatives.
  • Change Your Thinking About Cyberthreats: Think hard about risk and resilience.
  • Reassess the Risks to Your Organization -- Inside and Out: Don't be afraid to share intelligence.
  • Revise Information Security Arrangements: Collaborate with colleagues and share insight, and use those relationships to understand your vulnerabilities.

Organizations of all sizes need to ensure they are fully prepared to deal with these ever-emerging challenges by equipping themselves to better deal with attacks on their business as well as their reputation.

It may seem obvious, but the faster response you have, the better your outcome will be.

Related posts:

Steve Durbin is managing director of the Information Security Forum. His main areas of focus include strategy, information technology, cybersecurity and the emerging security threat landscape across both the corporate and personal environments. He is a frequent speaker and commentator on technology and security issues. Previously, he was a senior vice president at Gartner.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVE-2021-41394
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.
CVE-2021-41395
PUBLISHED: 2021-09-18
Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted database name or username.
CVE-2021-3806
PUBLISHED: 2021-09-18
A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system.
CVE-2021-41392
PUBLISHED: 2021-09-17
static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed vulnerable ipcRenderer IPC interface, which invokes the dangerous openExternal Electron API.