CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

Are the C-suite and security teams on the same page?
By Matt Lock, Director of Sales Engineers at Varonis
With every week seemingly bringing reports of another serious data breach hitting a high-profile
organisation, and the EU GDPR ushering in strict new data security laws, cyber security has finally
become a major priority for most companies. However, establishing a strong security strategy can
still be a difficult prospect.
One of the biggest challenges is aligning the various stakeholders in the business and bridging
the gaps between their disparate priorities and perceptions. In particular, the two most important
groups influencing the security of a company are the IT and security teams with direct experience
in the field, and the C-suite making the overall budgetary and strategic decisions. If these two
stakeholder groups are not on the same page, the company’s security strategy can become
fragmented and ineffective. Our own research has found that the priorities for the C-Suite and
IT/security teams can differ drastically in some cases.
The biggest cybersecurity worries
To begin, we wanted to gauge what kinds of cyber threats were causing the most concern, and
immediately found that the C-Suite and IT/security teams were in firm agreement that data loss
and data theft/exfiltration were the biggest worries. This supports the assertion in Europol’s
Internet Organised Crime Threat Assessment (IOCTA) that data is the ‘lifeblood’ for almost all
companies; it therefore follows that decisions around its protection, and management are of
strategic importance.