Cyber Defense Magazine - Annual RSA Conference 2019 - Print Edition

Inspiring Greater
Accountability with
Improved Security KPIs
By Lewie Dunsworth, EVP Technical Operations, Herjavec Group
Getting a good night’s sleep has become increasingly difficult for CISO’s. In
a recent Cybersecurity CEO piece Herjavec Group Founder & CEO, Robert
Herjavec, referenced how CISOs toss and turn, kept awake by thoughts of:
• Accountability to leadership – being held accountable to delivering
on expectations as the board approves investments to improve security
• Capability of team – questioning do I have the right skills
and right people to do the right things?
• Compliance & Privacy Regulation – how do GDPR, and other
industry or regional regulations impact my security program?
The good news is that the CEO
and board are more engaged
in cybersecurity conversations
than ever before. C-Level
members are no longer passing
off responsibility. CISOs aren’t
educating in the board room as
they used to – and trust me, I’ve
been in their shoes. The board is
asking the right questions and
holding their teams accountable.
I would confidently say the
C-suite is maturing when it
comes to security knowledge.
Keep in mind, each player around
that table may have slightly
different priorities:
- CEO – Concerned with
the reputation of the company in
the event of a breach. How could
credibility, customer retention
and overall stock price/business
value be impacted?
- CFO – How will we fund
ongoing security initiatives?
Are we maximizing the value of
our investments today? What
risk remains and what risk are
we sharing with 3rd parties,
including contractors, suppliers
and customers?
- COO – Will any
business operation be impacted
by the security program or
new technology roll out? Is the
roadmap on schedule? What
is our incident response plan to
regain business operation in the
event of a breach?
At the end of the day the C-Suite
shares mutual concerns about
security risk and liability in the
event of a breach. How you
communicate this and keep
them informed is pivotal.
As security becomes a more
digestible topic of conversation
at the quarterly board meeting
it’s imperative CISOs have the
proper metrics to measure their
progress and the inherent risks
that remain. Herjavec Group
recommends aligning early with
your executive leadership team
on a Security Roadmap – then
developing key performance
indicators (KPIs) that you can
report on so status updates and
progress measurements are
concise, clear and continue to be
digestible.
Cyber Defense Magazine - Annual Print Edition 2019 9