Increasing Board Accountability and Expertise Is Critical to Security and Risk Management

2017 saw huge numbers of people affected by breaches - 145 million consumer records in the Equifax breach, 200 million voter records in Deep Root Analytics breach, a firm which has contracted with the Republican National Committee, reprehensible corporate behavior (Uber’s breach cover-up); state-sponsored attacks (Russia and North Korea have been busy); and legislative response (by states, New York’s DFS, Congressional hearings, Senate proposals, and more). Harder to quantify, but certainly a major concern, is the erosion of public trust.

Given all the attention (and the apparent lack of progress), the year ahead is certain to bring further backlash from frustrated customers, shareholders, partners, and government agencies. How do Directors prepare for this increasing accountability? Tara Swaminatha, renowned legal expert specializing in cyber security liability and risk, recently outlined developments to watch in 2018, including the push to increase cyber security expertise on corporate boards.

The Board of Directors (BoD) is ultimately responsible for the future of their company. Shareholders expect that the companies they have invested in will follow through on specific, well-informed plans to mitigate risk in every form. As we’ve seen in cases like Target, Equifax, and Uber, the first move in response to scandal and public pressure is often the departure (voluntary or otherwise) of the CEO.

Boards Must Ensure Security Efforts Align with Risk Management

Innovations in technology, online services, and cybercrime exploits create disruptive ripple effects, creating new risks for organizations and consumers. Security and risk management programs have to be resilient enough to adapt to constant change. Boards and executives are uniquely positioned to ensure that security initiatives align with business strategy and take an enterprise-wide view of risk and opportunity.

No matter what technical systems, advanced controls, or frontline security experts a company has in place, no one can say they have zero risk of a security breach. The BoD needs to focus on asking, and answering, tough questions to ensure risks are understood and kept at acceptable levels. They must play out the scenarios — what would the aftermath of a breach look like in your organization? Would investigators find evidence of negligence, as in the Target Stores breach, or glaringly insufficient standards of care? In the final analysis, answers to these questions will determine levels of liability.  BoD’s have to understand this. 

The questions that frame this responsibility at a high level are these:

1. Does my company perform reviews on a regular basis for vulnerabilities that could present risk to us or our customers?
2. Has my company developed an Acceptable Risk Profile, and a methodology for prioritizing risks?
3. Does my company have a plan to address these risks, and are we executing against that plan

Board level reporting is key —BoDs need current, clear information about the effectiveness of their security programs, reported on a consistent basis. Specific examples of useful information for Board level decisions include:

• Trend data for measuring effectiveness of security investments;
• Year over year external security assessment test results;
• Employee security awareness training completion statistics;
• Results from incident response table top exercises; and third party risk reports.

Board Education and Risk Awareness

The BoD should approve an Acceptable Risk Profile that can help shape risk reduction programs and reporting. Boards should also review annual risk assessments and evaluate how resources are being allocated to address the findings. This assessment must include vendor/partner risks, a key area of focus for regulation and guidance in coming years. The BoD should constantly ask those responsible to demonstrate that the information security program is aligned to the risk profile of the company and that incident response plans are in place to address the breach and attack scenarios that are most likely to occur, and most likely to cause critical damage.

In short, the Board (or appointed committee) should maintain direct visibility into cyber security posture and improvement efforts. Supporting documentation for the FFIEC’s Cyber Security Assessment Tool contains related recommendations for Boards and CEOs. While this is a tool geared toward financial institutions, the guidance is broadly applicable. It’s important for Directors and executives to familiarize themselves with national standards like the NIST Cyber security Framework as well as risk management guidance specific to their industry.

Organizations are increasingly seeking to recruit board members with cyber security expertise. Boards also engage outside experts to support and inform their decision-making. To that end, the BoD must learn how to make the best use of external consultants and identify trusted sources of timely cyber security related information, while at the same time avoiding internal politics inherent in most organizations. Annual reports geared toward non-technical professionals will help BoDs stay up to date on threat environment trends and actual breach data (e.g., Verizon – Data Breach Investigation Report, Ponemon Institute, and other IT analyst firms).

Proactive Oversight, Continuous Improvement

To stay on top of security and build resilience into your organization, it’s important to put mechanisms in place for ongoing improvement. The technology used to develop both threats and countermeasures is on a very steep growth curve. Directors will find it useful to focus on the following as they plan ahead in 2018 and beyond: organizational structure; Acceptable Risk Profile and routine risk management reviews; internal and external resources for staying informed; and regular reporting that establishes metrics for baseline performance, improvement, and measurable results.

When it comes to cyber and information security, Directors cannot afford to be bystanders. Regulators, law enforcement, legislators, clients, and consumers are watching closely. Blaming cyber criminals, IT teams, and third parties won’t keep Boards and executives out of hot water. Shrewd, visionary leadership is required to build an integrated risk management and security program. Directors who combine mature cyber security awareness with deep industry experience have an increasingly important role to play in protecting their organization and positioning it for sustained success and growth.

About the author: Greg Reber is the Founder and CEO of AsTech, a leading information security consulting firm. Reber was among the first to recognize and address the risks presented by consumer-facing applications, and built AsTech’s reputation over 20 years as a leader in risk management.

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "http://ift.tt/2G9G8Fi"