CIO&Leader_July 2017 (1)

NEXTCSO Event Coverage
T
he worst thing about a security breach is
neither reputation risk nor the data theft
that compromises the privacy of an individual.
The worse is the inability to learn
from them - to turn the reactive approach
to a strategic one.
In the last one year, an average of 36.6M
records has been stolen in India - a 14%
increase from 2015. WannaCry and Petya
are recent ransomware attacks that have
yet again, raised questions about enterprises'
security preparedness.
Unfortunately, the cyber security professionals
haven't been able to keep up. Apex
body NASSCOM claims that India has a
50,000 cyber security workforce; however,
it predicts that we will need at least one
million skilled people by 2020.
According to ISACA’s State of Cyber Security
2017, 37% of respondents say fewer
than 1 in 4 candidates have the qualifications
employers need to keep companies
secure. The survey also reveals that almost
27% of respondents state that they are
unable to fill open cyber security positions
in their enterprises—with another 14% of
respondents unaware as to whether their
enterprises could fill these positions or not.
This leaves a quarter of cyber security
positions unfilled, the survey reports.
In the wake of mounting security incidents
– over 27,482 reported in 2017—
the government is taking some concrete
steps to appraise the role of the Chief
Information Security Officer (CISO).
Indian-Computer Emergency Response
Team (CERT-In) mandates all ministries,
departments and organisations to
appoint a CISO and have strengthened
the role to implement the right security
controls while promoting a culture of
defense. Banks and insurance companies
have also been mandated by regulatory
bodies such as RBI and IRDAI to appoint
a full-time CISO by April 30 and to formulate
an effective cyber crisis management
plan by June 30 of this year.
While the basic expectations from the
CISO will continue to remain the same:
information security (IS), information risk
management (IRM), data protection, and
oversight of audits, governance and compliance,
as well as technical, operational,
legal and regulatory risks.
But the basics won’t be enough.
With the business and threat landscape
changing rapidly, CISOs will have to
upgrade their skills and ensure that any
cyber security strategy contributes to
financial stability and growth, and embeds
security in all of the organization’s plans.
This means that organizations need to
appoint someone on your board who’s not
only dedicated to cyber security but also
understands regulatory requirements and
overall business strategy.
Perhaps that’s what will make a nextgeneration
CISO?
The aim of NextCSO Awards 2017 is
just that: To find exceptional individuals
who have the ability to take on the top job.
They are selected through a rigorous and
comprehensive process that will evaluate
professional achievements, management
and leadership skills that are essential to
the making of a next-gen CISO.
Here’s a glimpse into the NEXTCSO
Conference that celebrated the triumph
and victory of 24 next-gen CISOs and 20
NEXTCSO jury who handpicked them.
July 2017 | CIO&LEADER
9