Lessons From the Marsh ‘Global Cyber Risk Perception Survey’: Disconnects Persist Despite Increased Executive Involvement

“Most organizations now rank cybersecurity among their highest risk management priorities.” — Marsh’s “Global Cyber Risk Perception Survey”

In February 2018, Marsh and Microsoft released a new report titled “By the Numbers: Global Cyber Risk Perception Survey” based on a survey of over 1,300 risk professionals and other senior executives, including chief executive officers (CEOs), chief financial officers (CFOs), chief technology officers (CTOs), chief risk officers (CROs) and board directors, across 26 industries.

Participants came from organizations located around the globe. More than 30 percent of respondents’ organizations did business in Europe, the U.K. and/or Ireland, North America and Asia. In terms of organization size, their revenues ranged from less than $10 million (about 20 percent) to over $1 billion (over 22 percent). Continue reading at SecurityIntelligence.com

10 Takeaways From the ISO 31000:2018 Risk Management Guidelines

“Dealing with risk is part of governance and leadership, and is fundamental to how an organization is managed at all levels.” — International Organization for Standardization

In February 2018, the International Standards Organization (ISO) released an updated version of its risk management guidelines, ISO 31000:2018, which can be purchased for about $95. The 2018 update, which replaced the prior version from 2009, provides:

  • Updated and simplified language and reference structures;

  • A renewed focus on the key leadership role that boards and top management must play in ensuring that risk management is fully integrated at all levels of the organization; and

  • Greater attention to the cyclical and iterative nature of risk management, which underscores the notion that organizations must evaluate their risk management process in light of new information or in response to feedback about gaps that might be present in the current risk process or associated controls. Continue reading at SecurityIntelligence.com

Putting the ‘I’ in CISO: Why the Security Leader Must Become an Influencer

As an influencer, the CISO can play a key role in shaping the organization’s cybersecurity risk strategy. When the security leader’s influence reaches all the way into the boardroom, that influence can actually help save the organization money in the aftermath of a data breach.

One of the most important attributes of a chief information security officer (CISO) is the ability to govern by influence rather than edict. This skill is especially important given that, according to an August 2017 Ponemon report, many organizations struggle with conflicts related to turf and silo issues — nearly half of CISOs still report to chief information officers (CIOs) — and the lines of responsibility for cybersecurity are not always clearly defined.

To resolve these problems, CISOs must explore ways to become influencers within their organizations. But this doesn’t mean the security leader should have absolute authority and total control over the security program. As many CISOs have realized, the cybersecurity function is much more likely today to have veto power over projects, especially IT projects, than ever before. However, veto power can be a double-edged sword that (if abused) can halt innovation and influence employees to turn to shadow IT. Continue reading at SecurityIntelligence.com

Practicing Your Crisis Response: How Well Can You Handle Right of Boom?

Ultimately, a crisis simulation enables an organization to pressure-test its incident response plans — including who has decision-making authority and who communicates what to whom — identify gaps, and improve strategy and tactics accordingly. After all, it’s much better to go through a series of practice runs than to be thrown to the wolves when the real crisis happens.

If there’s one thing 2017 taught us, it’s that we need to get ready for the inevitable data breach — especially regarding how we respond once we know about the “boom,” which is the time we first learn of a security event.

A new report by IBM’s Institute for Business Value (IBV), “Beyond the Boom: Improving Decision Making in a Security Crisis,” emphasized the value of conducting crisis response simulations for top leadership. The report comes amid increased global awareness about the likelihood and impact of cyberattacks, as evidenced by the World Economic Forum (WEF)’s “2018 Global Risks Report.”

Another positive development is the shift from a primarily defense-oriented mindset to a more agile approach to cyber resilience. Continue reading at SecurityIntelligence.com

The Principles of a Safe Secure & Intelligent (S2I) Communications System

And that’s it. That is the entire basis for developing these principles, the rules of the road, these guiding lights, so that we can protect these systems we so dearly rely on.

What is a principle? The “know all” (aka, Google) tells us a principle is: “a fundamental truth or proposition that serves as the foundation for a system of belief or behavior or for a chain of reasoning.”

What is a communication system? The other “know all” (aka, Wikipedia) tells us a communication system is: “In telecommunication, a communications system is a collection of individual communications networks, transmission systems, relay stations, tributary stations, and data terminal equipment usually capable of interconnection and interoperation to form an integrated whole.” Continue reading “The Principles of a Safe Secure & Intelligent (S2I) Communications System”

Local LinkedIn pick as cybersecurity guru talks trends

I think government is traditionally been way behind on procurement issues and recently, enactment of legislation for modernization has taken place. They’re trying to replace a lot of legacy systems.

Our guest today was recently named by LinkedIn as one of the top five people to follow in cybersecurity issues among their 500 million members. He was also just selected as LinkedIn to be an advisor on cybersecurity and emerging technology issues, and we’re lucky enough to have him here in the studio– Chuck Brooks of Chuck Brooks Consulting. Chuck, thanks for joining us. Continue reading “Local LinkedIn pick as cybersecurity guru talks trends”

Where the CISO Should Sit on the Security Org Chart and Why It Matters

To ensure that the CISO is so empowered, top leadership must view and treat security as a strategic element of the business. In other words, they must view cyber risks as strategic risks. Internal collaboration with the security function should be supported and strongly encouraged at all levels of the organization.

In early 2016, boards were starting to take cybersecurity more seriously and, in the process, increasing their interactions with chief information security officers (CISOs). How much has changed in the past two years? To whom do CISOs report today, and why does it matter?

The State of the Security Org Chart in 2018

In the latest edition of its “Global State of Information Security Survey,” PricewaterhouseCoopers (PwC) found that 40 percent of CISOs, chief security officers (CSOs) or other equivalent information security executives report to CEOs, while 27 percent report to board directors, 24 percent report to a chief information officers (CIO), 17 percent report to a CSO and 15 percent report to a chief privacy officer (CPO). Since PwC’s numbers add up to more than 100 percent and the actual survey questions aren’t provided, these numbers likely include dotted lines of reporting in addition to direct reports. Continue reading at SecurityIntelligence.com

Five New Year’s Resolutions to Help CISOs Improve Enterprise Security in 2018

As we turn the page to 2018, organizations and their CISOs should commit to improving the way they consider, manage, communicate and respond to cybersecurity issues. That means introducing cognitive technology into the security environment, educating top leadership about cyber risks, promoting a culture of security awareness throughout all levels of the organization, conducting data breach simulations and tabletop exercises to hone incident response capabilities, and measuring the progress and maturity of security activities.

If you survived 2017 — a year full of data breaches, ransomware, distributed denial-of-service (DDoS) attacks and a multitude of other high-profile security incidents — you deserve a pat on the back. Some of us weathered the storm thanks to our careful preparations, the security controls we deployed, the incident response strategies we practiced and the recovery mechanisms we put in place. The rest of us can thank our lucky stars that things didn’t turn out for the worse.

Five Enterprise Security Resolutions for 2018

No matter how you navigated the treacherous threat landscape during the past year, it’s time for all of us in information security to make our New Year’s resolutions. If you’d rather not leave the fate of your organization to luck in 2018, here are five resolutions for chief information security officers (CISOs) to apply in the new year. Continue reading at SecurityIntelligence.com

Long Road Ahead or Unbridgeable Chasm? Lessons From the EY ‘Global Information Security Survey’

In many organizations, the executives need to increase the frequency and quality of interactions with the CISO and adopt a more hands-on approach to improving the way cyber risks are managed and governed. In companies where the cybersecurity function still reports to IT, dotted lines of reporting should be created to ensure direct access to top leadership.

If it appears to you that 2017 was a dismal year for cybersecurity, join the club: According to the latest edition of EY’s “Global Information Security Survey,” most security leaders feel they are more at risk today than they were 12 months ago.

The report surveyed chief information officers (CIOs), chief information security officers (CISOs) and other executives from 1,200 organizations around the world. More than 50 percent of survey responses came from small and midsized organizations with fewer than 2,000 employees. Although the top five sectors by respondents were banking and capital markets, consumer products and retail, government, insurance, and technology, other sectors, such as health, power and utilities, and real estate, were also included.

The report shed light on the state of cybersecurity and resilience, which is especially relevant since the global cost of cybersecurity breaches is estimated to reach $6 trillion by 2021. Cyberattacks are becoming more sophisticated, and new and disruptive technologies such as the Internet of Things (IoT) are rapidly increasing the level of connectedness across organizations, thus increasing the attack surface. Continue reading at SecurityIntelligence.com

Emerging Technologies and the Cyber Threat Landscape

Nothing is completely un-hackable, but there is a myriad of emerging technologies that can help us navigate the increasingly malicious cyber threat landscape.

Cybersecurity is at a tipping point, the sheer volume of breaches, attacks, and threats has become overwhelming.  Juniper Research, suggests that the rapid digitization of consumers’ lives and enterprise records will increase the cost of data breaches to $2.1 trillion globally by 2019. About 1.9 billion data records got exposed in the 918 data breaches that occurred in the first half of 2017—up 164 percent from the last half of 2016. According to a recent AT&T Cybersecurity Insights report, some 80 percent of the IT and security executives surveyed said their organizations came under attack during the previous 12 months.

This rising threat trend, coupled with the rapid growth of sophistication in malware, ransomware, DDoS, and social engineering attacks has created a conundrum. How do we protect ourselves in an increasingly connected world? Continue reading “Emerging Technologies and the Cyber Threat Landscape”