Nickel in demand

The increasing occurrence of
cybersecurity breaches – such
as the recent case at eBay when
it is believed more than 145 million user
accounts were infiltrated – is causing
executives around the globe to seek ever
more sophisticated solutions to prevent
future violations . As they review their
procedures, tighten their operational
environment and add additional levels of
security, finding the optimum formula is
still proving elusive.
Advances in security architecture
and cyber-defence tactics have helped
address some risks, but they are
inefficient and unsustainable when faced
with the more adaptive, embedded and
interconnected capability of the current
threat. Strengthening network resilience
is important but management responses
seem overwhelmingly reactive. The
criminal cyber threat is nimble and intensely
focused and, thanks to its financial success
to date, has the wherewithal to invest
in innovation and scale, often leaving
corporate security trailing in its wake.
Given that the cost of cybercrime to the
UK is currently estimated to be between
£18 billion and £27 billion, it is essential
that boards play a more proactive role. At
an operational level, working on the basis
that they will be faced with a cyber-attack
at some point, leadership teams need to
anticipate the business risk and develop
counter-measures and business continuity
plans which will minimise the disruption.
“we are starting to see the
creation of a new senior role on
the leadership team, that of the
Chief Security Officer (CSO)”
But how do they do this and who should
be in charge of driving the corporate
agenda on cybersecurity?
As boards acknowledge that technology
on its own is not enough, companies need
the addition of strong, well-organised
management with a broad range of
technical and non-technical capabilities.
In many instances, the responsibility
for cybersecurity falls on the CIO. This is
perfectly understandable but IT risk and
information security have now become
business issues and not simply technical
ones. Additionally, there is no department
that is immune to a cyberattack, or that
shouldn’t consider that certain activities
undertaken within that department may
give rise to a security breach, generated
either internally or externally. The challenge
here is to oversee the organisation’s
enterprise-wide risk management in an
effective way that balances managing risks
while adding value to the organisation.
In an increasing number of companies,
we are starting to see the creation of
a new senior role on the leadership
team, that of the Chief Security Officer
(CSO). Whilst the position of Head
of Security is not new, the role has
changed considerably in scope of
responsibility. Some organisations
are also distinguishing between the
Head of Physical Security and the
Head of Data Security.
Working alongside the CIO, the
CFO and others, one of the CSO’s
responsibilities is to advise the board and
senior executive team on existing risk
management procedures. He/she must be
able to demonstrate the effectiveness of
these procedures in identifying, assessing,
and managing the organisation’s most
significant enterprise-wide risk exposures.
As boards consider these risks, they must
decide whether their current risk oversight
and governance processes enable
40
[ Aug 2014 ] BE Monthly