Call us now:
Are we in danger of trying to fit a role into a position that it cannot deliver against yet. If we agree for one moment that cyber is an enterprise wide risk, then we need to think about the role cyber security plays in its management.
Cyber security is not cyber risk management. Cyber security supports the management of cyber risks and cyber risk management is a much bigger field. Some of the notable CISOs out there recognised that to be able to manage cyber security you need to understand risk and business operations, taking sabbaticals to work in those roles.
I’m the first to agree that cyber should be at the board table. But only if security professionals can manage the risk to the enterprise. Furthermore, as an observation, can we say that we have got the basics right today? Are we managing cyber security well enough across industry to be able to say we’re going to change gear and manage cyber risk. There are many articles about cyber security, few about cyber risk management and even fewer about how to manage cyber risk across an enterprise.
I just wonder if there is so much going on we’re missing the wood for the trees.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6646069177402605568