The Cyber Defense eMagazine November Edition for 2023

The more personnel that you train to be looking out for new dangers, the less likely the company may be
caught off guard by a vulnerability. To begin, a CISO must provide employees with basic risk
understanding and language. Explain the processes of managing risk and identifying potential problems.
Next, provide employees with a well-defined mechanism for reporting risks, and they will be more likely
to alert of potential issues before they become problems. Finally, use technology to acquire risk-related
information, boosting transparency and fostering a risk-aware culture throughout the organization.
Communication, escalation, and documentation
Communication and delegation are the most crucial aspects of risk management for the CISO. In a crisis,
CISOs are called to lead the technical incident response, assembling functional teams, delegating work,
and understanding when to repurpose resources to meet the demands of the incident. It is critical to
contact Crisis Management teams and discuss the business impact, with an understanding that difficult
decisions regarding containment must be taken. In a crisis, a CISO must communicate consistently using
neutral emotion. Doing so can help ensure judgments are sound and not hasty. Forming a risk
management team composed of stakeholders from several departments can avoid communication silos.
This is a good time to use technology as an aid in centralizing risk information, establishing a shared
language, and facilitating communication to address vulnerabilities. Finally, make sure there is
documentation throughout the process. Delegating a scribe to document all decisions is helpful and can
ensure the escalation process is followed, with the appropriate persons alerted. This provides CISOs with
a framework of checks and balances and shares responsibility of the response process.
Devise a new game plan
Currently, there is far too much emphasis on breach prevention and not enough on detection. In fact,
many breaches are not the result of inadequate cybersecurity prevention, rather of the organization's
poor detection and lack of cybersecurity knowledge. Organizations can focus on preventative measures,
such as reducing the attack surface to a more manageable level. This must be balanced with incident
response and crisis management.
Cybersecurity professionals, and specifically the CISO, must approach their role through the lens of
opportunity, rather than failure. Each cybersecurity incident provides an opportunity to learn from previous
mistakes, discover potential weaknesses in cybersecurity policy, and develop more effective measures
to assist the organization in preventing and detecting future attacks. It is not just about making a plan
with the intention of succeeding, but rather about accepting that failures are likely to happen - but by
being prepared to adjust plans, you’ll be well-positioned to minimize any damages.
Cyber Defense eMagazine – November 2023 Edition 109
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.