Nickel in demand

technology
them fully to understand the potential
impact on corporate strategy.
The CSO’s position must interface
with other business areas such as IT,
Legal, Human Resources, operations and
corporate communications. Therefore,
even though heads of IT possibly could
take on this role, suitable candidates must
have a strong commercial ethos as well,
with a global view on the impact of the
cyber threat and a solid understanding of
the changing threat landscape.
The scope of this level of awareness
needs to encompass a range of assets,
systems and activities, including some
perhaps not previously considered as
‘at risk’. These will include assets held
by external organisations – such as
suppliers – since attacks frequently come
indirectly through these third parties.
Earlier this year, Target, the USA’s second
largest discount retailer reported that
the personal information of as many as
110 million customers was compromised
after hackers reportedly installed malware
onto the retailer’s point-of-sale machines
through one of its suppliers.
Given the need to establish a balance
between creating and sustaining a
secure environment, whilst also enabling
end-users to work unhindered, an
experienced CSO should also be a strong
team player capable of embracing and
managing change and collaborating
with others through information and
intelligence sharing. Finding someone
with the right credentials for the role is
a challenge. Growing demand is already
outstripping supply of the most qualified
people, so CEOs may need to consider
executives who have some – but maybe
not all – the skills required, and provide
the time and facilities for that person
to develop accordingly.
How the board views and responds to
the cyber threat is equally important. As
“the cyber threat is a question
of ‘when’ rather than ‘if’, and
organisations need to prepare
accordingly”
with many aspects of the board’s role, this
is as much about knowing what questions
to ask – and being satisfied as to the quality
of the answers – as it is about expert or
technical knowledge. Indeed, discussing
the technical minutiae is almost certainly
not the best use of the board’s time.
Rather, and this will become increasingly
an issue to be reviewed in annual reports
and regulatory processes, the board will
need to demonstrate to stakeholders
– investors, customers, employees and
regulators where relevant – that they are
fulfilling their responsibility of assurance:
setting the strategic framework and
holding management to account.
In the final analysis, the cyber threat is
a question of ‘when’ rather than ‘if’, and
organisations need to prepare accordingly,
even though the nature and target of the
threat are constantly changing . What hasn’t
changed, however, is the responsibility
of security specialists, management
teams and boards to provide technical
capability, business resilience and strategic
oversight respectively.
About the author
Robin Murray Brown
Partner at executive search
consultants, Tyzack.
www.tyzackpartners.com
BE Monthly [ Aug 2014 ] 41