Call us now:
What I find interesting is that those in cyber security have said for many years it’s one of the biggest non-financial risks a company has to manage. The cost of managing the risk is much less than the costs of managing the fall out. It’s an asymmetric risk, one which relies on the good guys to protect everything however small and the bad guys to be successful only once.
When its more profitable to hack than to sell drugs, guns or people traffic. When there’s a shortfall of qualified good guys of between 1 – 3 million world wide. When regulators pass data and cyber legislation. When it only takes 1 seemingly innocuous intrusion to cause the damage. It should send a warning.
The Capital One case will be interesting. It maybe one of the first cases in the US main stream, where cyber laws are tested. The New York state attorney will assess the breach, this may put it under the NY DFS regulation (https://lnkd.in/ee5pG6M).
Boards want things simple, that’s what we’re all taught. But cyber, the message, the remediation and the management are complex. There is no simple message and a paragraph and a few charts on a quarterly board paper will not provide oversight.
At least the fines maybe simple, to the nearest $10Mn.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6562615395348463616