So the whole idea of security planning and security management
is to be better prepared when it comes to cyber security.
So, if your enterprise, your company,
if your ask how well prepared you are, how good is the state of cyber security?
Really, that's what the cyber security posture is.
So, cyber security posture,how do we address our security, how do we prepare
ourselves for cyber security, how do we handle when something goes wrong.
The posture can either be reactive, unfortunately,
in many cases, this is what it is.
What does reactive mean?
Well, we worry about it, because we're sort of forced to do it.
Because there's a regulation compliance requirements they say you must do so.
And we react to that regulation that comes down our throats.
All it's customer's demands,
customer's saying I will not do business with you unless you have that.
Lot of companies these days, especially business to business,
b to b, they don't want to business with someone who has lax cyber security.
So again,
we react to this demand that comes from somebody we want to do business with.
It could be in response to something bad that happens to us, okay.
So breach for example, the target, Home Depot examples, everybody talks about.
So, we react to the adverse event that we suffered, so
that's another example of what reactive security posture is.
And, finally, it may be in response to events that occur,
our competition may have suffered.
One bank, for example, suffers a bridge and
other banks may react to that by making sure that
the vulnerabilities that were exploited don't exist in their IT systems.
So all these are examples of, so this is a reactive posture, I said,
unfortunately security is event driven when something something bad happens.
People say, we need it and so we need to do something about.
But this is what is called a reactive posture to cyber security.
Of course,
it's better to have what is called a pro active approach to security.
You plan for it, that's what security planning is talking about.
You work hard to assess your risk, you do things to reduce it, look at the cost
and do that before either you're forced because of regulation or
forced because something bad happens to you and you respond to it reactively.
So what are some examples of proactive things that companies should be doing?
Well first of all, it should be somebody's job to worry about cyber
securities and assets, how they protect it,
how people are educated, cyber security insurance, having a good policy.
Making sure people are held responsible and empowered to do things, and all
the things we talked about when it comes to security planning and management.
So having a champion whose job it is to worry about it,
a champion should have influence.
If is doesn't, he or she doesn't have influence of
course you're not going to get anything meaningful done.
So one thing people talk about, for example, is well,
is this proactively addressed at the highest level in an organization?
Talk about the board level conversation.
The board addresses various kind of risks an enterprise has to deal with.
Is cyber security risk one of those, or is there a conversation about it?
Is there a conversation about what needs to be done to reduce that risk?
Is there an investment made in cyber security controlled in solutions and
personnel and things like that?
If that's done before bad things happen, that would be a proactive approach.
It's again unfortunately not aware this is happening in every company.
In fact, one of the things that happened we said target hired a CSO,
who does the CSO report to?
Does the CSO report to CIO?
Well when it's not talking about the highest level it doesn't
report to the CEO.
The CEO maybe doesn't bring it up at the board level and things like that.
So proactive means somebody, the champion, looks ahead,
has the influence that's necessary and has support at the highest levels and
that would be a proactive posture for cyber security.