O ne of the most common misunderstandings about cyber security with regards to executives is
that executives think that cyber security is an i.t problem whereas in reality it is a
business and management issue. When the breaches happen, everybody is blaming everybody else in
the organization and there is no delegation of responsibility. So it is very important that
a company should have a CISO and in case, you know, if it's a small-sized company which cannot
afford CISOs because they're very expensive they could go with something that is known as
vCISO. So, we in Cyber Citadel you know we offer vCISO services. So, transparency is the key
and the key to a successful cyber security posture in modeling your company. One of the main issues
that we see when we are assessing the security posture of on organization and this is something
that we flag at risk is the fact that we have a head of cyber security who's reporting to the CTO.
Of course that is a conflict of interest. If you want to ensure security in a company and if you want
to ensure that security is going to be treated as priority and would be integrated into all business
processes you would want you know the head of cyber security or the CISO to be able to report
to the board or to the CEO. Now that way of course a lot of things that are being put under carpet
you know come to limelight. That way you could ensure the transparency across the system and
all in all you know you could achieve a better cyber security posture. The benefits of working
with external companies are pretty clear. There are many regulations that demand companies to do
an external pen test. For instance, if you look at PCIDSS, it demands the companies to do
external pen tests once every year. And more and more regulations are coming along the same
lines. Why they are doing that is because of the conflict of interest. If you are
a company and the sole purpose is to protect your business and in the process of doing that
you would like to avoid you know regulatory fines and everything along those lines
then of course you know we have seen scenarios whereby a lot of these small issues that have
came from these internal audit reports have been put under carpet. Now when a breach happens
and when we do a post-breach analysis then we find out that these issues were previously you
know discussed but they were put under the carpet due to the fact that the head of security or the
CTO or the person that is managing security in your organization does not want to look bad in
front of the senior management and the CEOs. And therefore there is a need of an external partner
that would help you. And in case if you want to present your report to the regulator, regulator
encourage you to do an external third party report. There are aspects of enterprise-wide
security risk management programs that need to be driven by senior management and executives. And
executives are responsible for fostering the cyber security culture into the company.
Now this is a gap that needs to be bridged. There has to be training for board members and senior
executives so that they are able to comprehend the risks that are going to affect their organization
and therefore they could take informed strategic decisions on basis of that.
One of the key concepts that you need to understand is the fact that digital transformation
can make their businesses more secure and can lead to a better accountability only if cyber security
is included in every business process. The other thing that senior executives need to understand
is that in any board management discussion they should talk about enterprise-wide risk
and they should talk about you know risk that need need to accept risk that they need to
you know transfer to the insurance and the risks that need to be mitigated. If you have a
proper cyber security program implemented in your company, this would mean that your business is more
resilient to cyber attacks. Now this would lead to greater customer trust in your products.
Because what we have seen is that companies that have suffered the reputational damage has
been more than the financial damage. If you look at the example of facebook, facebook has been
compromised multiple times. Facebook's platform was used to meddle with US elections 2016, whereby we
had seen Cambridge Analytica getting hold of around 87 million people and their personal data and
of course creating a psychometric profile which they would use to micro-target and
micro-segment the audience and then target them based upon their behaviors. And of course, you know,
Facebook has lost customer confidence. But overall to put things into the perspective, if your business
is more resilient to cyber attacks that would mean that in case of adverse circumstances it
would continue to function and what this could lead to is to greater customer confidence