“The Year of the Data Breach” was ugly for consumers, alarming to IT teams, and nerve-wracking for boards and executives. But wait, what year are we talking about? Unfortunately, this description is just as apt for 2013 as it is now. In the past year, we’ve seen this unfortunate trend intensify on many levels – and intense it has been. 2017 saw huge numbers of people affected by breaches – 145 million consumer records in the Equifax breach, 200 million voter records in Deep Root Analytics breach, a firm which has contracted with the Republican National Committee, reprehensible corporate behavior (Uber’s breach cover-up); state-sponsored attacks (Russia and North Korea have been busy); and legislative response (by states, New York’s DFS, Congressional hearings, Senate proposals, and more). Harder to quantify, but certainly a major concern, is the erosion of public trust.
Given all the attention (and the apparent lack of progress), the year ahead is certain to bring further backlash from frustrated customers, shareholders, partners, and government agencies. How do Directors prepare for this increasing accountability? Tara Swaminatha, renowned legal expert specializing in cyber security liability and risk, recently outlined developments to watch in 2018, including the push to increase cyber security expertise on corporate boards.
At AsTech, we understand that the Board of Directors (BoD) is ultimately responsible for the future of their company. Shareholders expect that the companies they have invested in will follow through on specific, well-informed plans to mitigate risk in every form. As we’ve seen in cases like Target, Equifax, and Uber, the first move in response to scandal and public pressure is often the departure (voluntary or otherwise) of the CEO.
Boards Must Ensure Security Efforts Align with Risk Management
Innovations in technology, online services, and cybercrime exploits create disruptive ripple effects, creating new risks for organizations and consumers. Security and risk management programs have to be resilient enough to adapt to constant change. Boards and executives are uniquely positioned to ensure that security initiatives align with business strategy and take an enterprise-wide view of risk and opportunity.
No matter what technical systems, advanced controls, or frontline security experts a company has in place, no one can say they have zero risk of a security breach. The BoD needs to focus on asking, and answering, tough questions to ensure risks are understood and kept at acceptable levels. They must play out the scenarios — what would the aftermath of a breach look like in your organization? Would investigators find evidence of negligence, as in the Target Stores breach, or glaringly insufficient standards of care? In the final analysis, answers to these questions will determine levels of liability. BoD’s have to understand this. The questions that frame this responsibility at a high level are these:
- Does my company perform reviews on a regular basis for vulnerabilities that could present risk to us or our customers?
- Has my company developed an Acceptable Risk Profile, and a methodology for prioritizing risks?
- Does my company have a plan to address these risks, and are we executing against that plan
Board level reporting is key — BoDs need current, clear information about the effectiveness of their security programs, reported on a consistent basis. Specific examples of useful information for Board level decisions include:
- trend data for measuring effectiveness of security investments;
- year over year external security assessment test results;
- employee security awareness training completion statistics;
- results from incident response table top exercises; and third party risk reports.
Board Education and Risk Awareness
The BoD should approve an Acceptable Risk Profile that can help shape risk reduction programs and reporting. Boards should also review annual risk assessments and evaluate how resources are being allocated to address the findings. This assessment must include vendor/partner risks, a key area of focus for regulation and guidance in coming years. The BoD should constantly ask those responsible to demonstrate that the information security program is aligned to the risk profile of the company and that incident response plans are in place to address the breach and attack scenarios that are most likely to occur, and most likely to cause critical damage.
In short, the Board (or appointed committee) should maintain direct visibility into cyber security posture and improvement efforts. Supporting documentation for the FFIEC’s Cyber Security Assessment Tool contains related recommendations for Boards and CEOs. While this is a tool geared toward financial institutions, the guidance is broadly applicable. It’s important for Directors and executives to familiarize themselves with national standards like the NIST Cyber security Framework as well as risk management guidance specific to their industry.
Organizations are increasingly seeking to recruit board members with cyber security expertise. Boards also engage outside experts to support and inform their decision-making. To that end, the BoD must learn how to make the best use of external consultants and identify trusted sources of timely cyber security related information, while at the same time avoiding internal politics inherent in most organizations. Annual reports geared toward non-technical professionals will help BoDs stay up to date on threat environment trends and actual breach data (e.g., Verizon – Data Breach Investigation Report, Ponemon Institute, and other IT analyst firms).
Proactive Oversight, Continuous Improvement
To stay on top of security and build resilience into your organization, it’s important to put mechanisms in place for ongoing improvement. The technology used to develop both threats and countermeasures is on a very steep growth curve. Directors will find it useful to focus on the following as they plan ahead in 2018 and beyond: organizational structure; Acceptable Risk Profile and routine risk management reviews; internal and external resources for staying informed; and regular reporting that establishes metrics for baseline performance, improvement, and measurable results.
When it comes to cyber and information security, Directors cannot afford to be bystanders. Regulators, law enforcement, legislators, clients, and consumers are watching closely. Blaming cyber criminals, IT teams, and third parties won’t keep Boards and executives out of hot water. Shrewd, visionary leadership is required to build an integrated risk management and security program. Directors who combine mature cyber security awareness with deep industry experience have an increasingly important role to play in protecting their organization and positioning it for sustained success and growth.