Call us now:
A topical post by Associate Professor Noah Barsky Villanova School of Business and Executive Director Dr. Keri P. research consortium MIT Sloan School of Management on the challenges boards face with the increasing complex, national security risk, that is cybersecurity.
It’s not so much that boards over estimate their companies cybersecurity. It’s that boards have no real baseline to compare their companies maturity against, cybersecurity risk management is treated as a destination and not a journey. One only has to go back to Not-Petya in 2017 to understand boards reluctance to manage cyber risk. History is littered with cyber incidents demonstrating their effect.
We’ve all heard of board meetings where management compare how much they spend on cyber against expected outcomes, when asked ‘how good is our cyber’…………….’we’re all green sir, were secure.’ On the cyber journey you are never completely secure, just go ask Marks and Spencer, UnitedHealth Group, MGM.
Boards invariably and rarely have realistic conversations about cybersecurity risk, they can’t, there’s never enough time, resource or available data; 99% of board members have little or no understanding of cyber risk and have no appetite to understand cyber risk. Board members are more likely to pass cyber down the organisation to the CFO, COO or audit committee to manage; board governance over cybersecurity risk is poor despite a boards fiduciary responsibilities to demonstrate the management of risk; cyber is a complex risk to manage, full of acronyms and lets face it no one likes to know that ‘if I spend $millions on managing a risk, I still may not be secure……………….an unfortunate truth’
Another issue is market forces and snake oil sales. No amount of tech is going to secure an organisation, it’s why banks employ 100’s of people to manage cyber risk and embed cultures of cyber risk management. The final issue is home grown, there are no professional qualifications for a CISO, no professional body to place assurance over the quality of a leader in security. As there are with finance, legal or audit professionals. So who can assess the quality of what the board is buying, especially important when your recruiting a role to protect the companies financial statements.
Cybersecurity is a journey, its not a destination. It’s one of the most complex risks sitting on the board table. Unfortunately we are paying the price for burying our heads in the sand and ignoring a risk that has started to rear its head as a national and economic security risk and risk to society.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC Tanya Gass
#cybersecurity #cyberriskmanagement #cyberattack
https://lnkd.in/eHgeeKrc
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7333112594427224065