In the Hot Seat: Boards Under Pressure to Focus on Security and Risk Management

“The Year of the Data Breach” was ugly for consumers, alarming to IT teams, and nerve-wracking for boards and executives. But wait, what year are we talking about? Unfortunately, this description is just as apt for 2013 as it is now. In the past year, we’ve seen this unfortunate trend intensify on many levels – and intense it has been.  2017 saw huge numbers of people affected by breaches – 145 million consumer records in the Equifax breach, 200 million voter records in Deep Root Analytics breach, a firm which has contracted with the Republican National Committee, reprehensible corporate behavior (Uber’s breach cover-up); state-sponsored attacks (Russia and North Korea have been busy); and legislative response (by states, New York’s DFS, Congressional hearings, Senate proposals, and more). Harder to quantify, but certainly a major concern, is the erosion of public trust.

Given all the attention (and the apparent lack of progress), the year ahead is certain to bring further backlash from frustrated customers, shareholders, partners, and government agencies. How do Directors prepare for this increasing accountability? Tara Swaminatha, renowned legal expert specializing in cyber security liability and risk, recently outlined developments to watch in 2018, including the push to increase cyber security expertise on corporate boards.

At AsTech, we understand that the Board of Directors (BoD) is ultimately responsible for the future of their company. Shareholders expect that the companies they have invested in will follow through on specific, well-informed plans to mitigate risk in every form. As we’ve seen in cases like Target, Equifax, and Uber, the first move in response to scandal and public pressure is often the departure (voluntary or otherwise) of the CEO.

Boards Must Ensure Security Efforts Align with Risk Management

Innovations in technology, online services, and cybercrime exploits create disruptive ripple effects, creating new risks for organizations and consumers. Security and risk management programs have to be resilient enough to adapt to constant change. Boards and executives are uniquely positioned to ensure that security initiatives align with business strategy and take an enterprise-wide view of risk and opportunity.

No matter what technical systems, advanced controls, or frontline security experts a company has in place, no one can say they have zero risk of a security breach. The BoD needs to focus on asking, and answering, tough questions to ensure risks are understood and kept at acceptable levels. They must play out the scenarios — what would the aftermath of a breach look like in your organization? Would investigators find evidence of negligence, as in the Target Stores breach, or glaringly insufficient standards of care? In the final analysis, answers to these questions will determine levels of liability.  BoD’s have to understand this.  The questions that frame this responsibility at a high level are these:

  1. Does my company perform reviews on a regular basis for vulnerabilities that could present risk to us or our customers?
  2. Has my company developed an Acceptable Risk Profile, and a methodology for prioritizing risks?
  3. Does my company have a plan to address these risks, and are we executing against that plan

Board level reporting is key — BoDs need current, clear information about the effectiveness of their security programs, reported on a consistent basis. Specific examples of useful information for Board level decisions include:

  • trend data for measuring effectiveness of security investments;
  • year over year external security assessment test results;
  • employee security awareness training completion statistics;
  • results from incident response table top exercises; and third party risk reports.

 Board Education and Risk Awareness

The BoD should approve an Acceptable Risk Profile that can help shape risk reduction programs and reporting. Boards should also review annual risk assessments and evaluate how resources are being allocated to address the findings. This assessment must include vendor/partner risks, a key area of focus for regulation and guidance in coming years. The BoD should constantly ask those responsible to demonstrate that the information security program is aligned to the risk profile of the company and that incident response plans are in place to address the breach and attack scenarios that are most likely to occur, and most likely to cause critical damage.

In short, the Board (or appointed committee) should maintain direct visibility into cyber security posture and improvement efforts. Supporting documentation for the FFIEC’s Cyber Security Assessment Tool contains related recommendations for Boards and CEOs. While this is a tool geared toward financial institutions, the guidance is broadly applicable. It’s important for Directors and executives to familiarize themselves with national standards like the NIST Cyber security Framework as well as risk management guidance specific to their industry.

Organizations are increasingly seeking to recruit board members with cyber security expertise. Boards also engage outside experts to support and inform their decision-making. To that end, the BoD must learn how to make the best use of external consultants and identify trusted sources of timely cyber security related information, while at the same time avoiding internal politics inherent in most organizations. Annual reports geared toward non-technical professionals will help BoDs stay up to date on threat environment trends and actual breach data (e.g., Verizon – Data Breach Investigation Report, Ponemon Institute, and other IT analyst firms).

Proactive Oversight, Continuous Improvement

To stay on top of security and build resilience into your organization, it’s important to put mechanisms in place for ongoing improvement. The technology used to develop both threats and countermeasures is on a very steep growth curve. Directors will find it useful to focus on the following as they plan ahead in 2018 and beyond: organizational structure; Acceptable Risk Profile and routine risk management reviews; internal and external resources for staying informed; and regular reporting that establishes metrics for baseline performance, improvement, and measurable results.

When it comes to cyber and information security, Directors cannot afford to be bystanders. Regulators, law enforcement, legislators, clients, and consumers are watching closely. Blaming cyber criminals, IT teams, and third parties won’t keep Boards and executives out of hot water. Shrewd, visionary leadership is required to build an integrated risk management and security program. Directors who combine mature cyber security awareness with deep industry experience have an increasingly important role to play in protecting their organization and positioning it for sustained success and growth.


Add Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Leader
How to Build a Great Leadership Team: 6 Conditions for Success
Customer Loyalty
Becoming a Must-See Destination: Building Customer Loyalty
Chess pawn game plan
What Does Leadership Mean to You?
Glen Taylor Timberwolves
10 Things You Didn’t Know about Minnesota Timberwolves Owner Glen Taylor
Credit cards in wallet in back pocket
7 Elements of a Good Credit Application
budgeting in the office
Three Ways Budgeting Our Money Actually Makes Us Richer
thermometer
10 Pharmaceutical Stocks to Consider in 2019
DJIA
The History and Evolution of the DJIA
Uptime
Prioritizing Security to Future-Proof Enterprise Collaboration
Does Artificial Intelligence Have Ethics?
Cloud Attack
Top 8 Cyber Security Trends in 2019 You Should Look out For
ClimaCelll
Why ClimaCell Could be a Game Changer in Weather Forecasting
Four Mexican Getaways You Need to Try At Least Once
Family Friendly Vacation to Dillion, Colorado
Denver
20 Awesome Free Things to Do in Denver
Boston view from the park
20 Awesome Free Things to Do in Boston
The 20 Most Fuel Efficient Cars in 2019
2013 Nissan GTR
The 10 Most Expensive Cars to Maintain in 2019
The 20 Best Chevy SUVs of All Time
Ferrari 458 Speciale
8 Cars That Have Big Investment Potential in 2019
Timex MK1 Steel Watch With White Dial
The 10 Best Timex Watches of 2019
Fossil Sport
The 10 Best Fossil Watches of 2019
Hamilton Watches feature
The 10 Best Hamilton Watches of 2019
The 20 Best Tourbillon Watches in 2019