CISOs Need Backing To Take Charge Of Security

Újra kiadta Platón

Követő: 0

CISOs Need Backing to Take Charge of Security PlatoBlockchain Data Intelligence. Vertical Search. Ai.

A találmány egy legutóbbi jelentés, only 5 of the Fortune 100 companies count their head of security when listing top management.

A A CISO szerepe és kapcsolata a befolyással and influence has always been a dance with the corporate old guard. Does the CISO truly have the authority to stop a line-of-business executive from doing something risky? And if the CISO tries, will the A CISO támogatást kap a vezérigazgatótól és mások?

Egy nemrégiben A LinkedIn beszélgetést Derek Andrews kezdeményezte, the director of cybersecurity operations and incident response for a large nonprofit that he said he would rather not identify, encapsulated the fears quite well.

“The CISO role isn’t really the chief of anything other than being the person to take the fall when the time is right. CISOs aren’t in the CEO inner circle. They’re like the fourth ring out. That means that the security sell has to go through three others before it gets real organizational approval and, by that time, it’s watered down to doing more phishing training,” Andrews wrote.

Andrews ezután egy kritikus kérdést vetett fel: Miért engedik meg a vállalatok minden üzleti egységnek, hogy saját maga döntsön arról, ha valami túlzottan kockázatos, nem pedig a CISO?

“I’ve never seen any place that allowed each business unit to run its own network. So why are we allowing someone in marketing to accept a cyber risk that can impact every business unit in the org? Acceptance would mean ownership and we all know that accountability never comes to cyber risk accepting business units. It’s the CISO that takes the fall,” Andrews wrote. “The CFO has final authority when it comes to financial risk and performance. You’ll never hear a CFO say ‘Well, if you accept the risk, then you can do it.’ This isn’t something they do. As the chief they are the final authority and are held accountable for everything under their domain.”

Ismerje meg a Leadership Lingo-t

Why do enterprises give their CISOs so much less power than other C-level executives? This doesn’t merely undermine the enterprise cybersecurity strategy. It can have the indirect impact of lessening the security posture even more, as CISOs become gun-shy that they’ll be overridden and start greenlighting efforts that they know should not be approved.

Barak Engel, the CEO of the security firm EAmmune and Szerzője Miért nem sikerül a CISO-k?, azzal érvel, hogy ennek a problémának a nagy része a Wall Street és más piaci erők következménye. Amikor jelentős biztonsági incidenseket jelentenek be, a vállalatok néha zuhanást tapasztalnak részvényeik árfolyamában, de ez szinte mindig nagyon átmeneti.

„A jogsértéseknek nincs hosszú távú negatív hatása. A részvényárak meglehetősen gyorsan helyreállnak” – mondja Engel. „A vezérigazgató lényege, hogy a biztonság az első néhány hónap után nem számít. De a CISO-k nagyon ijesztőnek tartják, a vezérigazgatók pedig szkeptikusak.”

Bár sokszor elhangzott, Engel fenntartja, hogy ez visszaköszön A CISO-k nem kommunikálnak hatékonyan to the CEO — and business unit heads — in pure business terms. “Just once I want to hear a CISO use the term ‘cashflow.’ If all we hear from you are scary stories, then you haven’t learned what it means to be a C-level. You have not adopted the language of the business,” he says.

Építsd ki az üzleti bevásárlást

A probléma másik része a relatív újdonság, legalábbis a vezérigazgató stratégiai lapján, of cybersecurity. The CEO suite at Fortune 500 companies has had generations of experience understanding and getting comfortable with risks and uncertainties that exist within legal, financial, HR, IR, compliance, and other business units. But cybersecurity risk seems awkward and difficult to master to many CEOs.

“Most business risks are static, but cyber risk absolutely is not,” says Dirk Hodgson, the director of cybersecurity for NTT Australia. “In cybersecurity, the risks are not universally agreed or clear. It may not be disrespect of the CISO as much as poor communications in a business context. There is a fundamental difference in expectations between cybersecurity and other business units. Until we fix that, we’re going to be stuck in the same spot.”

Oliver Tavakoli, the CTO of Vectra AI, argues that the nature of cybersecurity itself causes this issue. Even though the CISO is issuing regular memos to top executives about various issues, they are often ignored until a security emergency happens.

„A kiberbiztonsággal csak válság idején foglalkoznak. Szinte mindig ez a beszélgetés negatív helyzetben történik. Ez nagyon megnehezíti ennek a kapcsolatnak a kialakítását” – mondja Tavakoli. „A legtöbb CISO ragaszkodik ahhoz, hogy más CISO-k hőse legyen, és nem a C-suite többi részének.”

Adds Brian Walker, the CEO of the Cap Group, a cybersecurity consulting firm: “It’s all about authority and respect. If you have the authority and your boss doesn’t back you up, then the CISO doesn’t really have the authority.”