Board Level Cyber Risk Management Standard Needed

Calls for company boards to be active governance partners in “collaborative cyber defence” have been made in the Advanced Cyber Security Center's (ACSC)   effective practice report, “Leveraging Board Governance for Cybersecurity, The CISO / CIO Perspective." The report urges boards and their directors to adopt a dynamic understanding of their organisation’s cybersecurity responsibilities and to maintain regular direct access to CISOs and risk officers in conjunction with CIOs and other executives.


Importantly, the report seeks to create an initial benchmark and method of evaluation for the evolving role of corporate boards in cybersecurity governance, initially through the perspective of Chief Information Security Officers (CISOs), Chief Security Officers (CSOs) and Chief Information Officers (CIOs), the primary networks supported by the nonprofit, member-based Advanced Cyber Security Center (ACSC).


P{rimary recommendations of the report are:


The board’s strategic risk role: In most cases, the board partnership with management is still “at an early stage” or “maturing” phase in its ability to provide strategic guidance and help guide management’s strategic risk judgments.


Building board cyber expertise: Because most boards do not yet have sufficient expertise in technology or cybersecurity to serve as strategic thought partners on cyber risk, they should recruit board members with broad digital/technology expertise, develop an annual curriculum of cyber briefings, provide ongoing training, and use third-party assessments.


Aligning the board role and corporate structures: CISOs and CIOs should present jointly at board meetings to provide a holistic view of digital strategies and security.  Boards as a whole should review cybersecurity more consistently as a business risk; the risk or audit committee should be used for more frequent (at least quarterly) cyber reviews.


Overseeing cybersecurity and digital transformation budgets: Boards should present digital transformation budgets as a whole, with cybersecurity investments as an element of overall IT-related decisions about where to invest in growth and security.


Developing cyber risk metrics and measurement: Boards should prioritise and support senior management’s development of a new generation of outcome-based cyber risk management frameworks, and in the meantime, executives should use only a few operational metrics with boards.


The full report can be seen here

more news

Varonis Blog Highlights 110 Cybersecurity Statistics


Cybersecurity company Varonis has issued its predictions for the forthcoming year with a blog post entitled 110 Cybersecurity Statics For 2020. The blog states that cybersecurity issues are becoming a day-to-day struggle for businesses. Recent trends and cybersecurity statistics reveal a huge increase in hacked and breached data from sources that are increasingly common in the workplace, like mobile and IoT devices.

read more

UK To Go On The Cyber Offensive


The UK Government is about to launch a new proactive and offensive cybersecurity team that will wage cyberwarfare against hostile nation-states and online crime organisations. It would be naive to believe that the UK has not launched cyberattacks against third parties, but the killing of Qassem Soleimani has brought this out into the open.

read more

Are You Ready For Iranian Revenge Cyberattacks?


Following the killing of Qassem Suleimani no-one can be sure of what military action Iran will take, but experts agree that its cyberattacks will increase against countries and governments it sees as hostile.

read more

Ringing The Changes For IOT Security


Buying and installing a cyber-doorbell through which you can monitor callers even if you are away from home makes sense, yes? Not unless you are a user from Alabama who has launched a $5million legal against action after it is alleged that a hacker cracked the Ring doorbell and started harassing the family.

read more