info@ceoworld.biz
Tuesday, March 19, 2024
CEOWORLD magazine - Latest - CEO Advisory - Executives need to learn more about security to combat cyber threats

CEO Advisory

Executives need to learn more about security to combat cyber threats

When C-level professionals don’t know nearly enough about common security threats, the whole company is at risk.

This many years into the digital era, it’s not exactly news that technology security isn’t only a technology concern—it’s an employee issue, a companywide focus, a boardroom priority. That last one is particularly important. It should be safe to assume that given the budget outlays involved (and the potential threats to the infrastructure) every C-level executive is at least well aware of the value in IT, and remains cognizant of the dangers. Or not.

A pair of recent Nominet studies surveying C-Level executives goes past the data sets, innovation and automation to examine a more neglected constituency: the people, those launching attacks and those responsible for stopping them. In this context, the Chief Information Security Officer (CISO) makes for a perfect prism. This is a dynamic role that balances technology with business, people with processes, budget allocations with bottom-line concerns, and advocacy with diplomacy. Perhaps, most importantly, it illustrates the executive suite’s familiarity with the technology threat matrix. Or, to put it more accurately, the lack of familiarity.

The research polled 400 C-suite executives in the US and UK, and here’s a sampling of the results:

  • 78% of the executives surveyed admit to gaps in their knowledge about malware
  • 68% concede to knowledge gaps about phishing
  • 66% need to learn more about ransomware
  • 72% don’t know much about crypto mining

These are not abstract concepts: Ransomware has become such a potent strategy that entire cities are paying out ransom money to get data back, rogue nations are deploying malware to cripple critical infrastructures, and many attacks with profit motives start with phishing and then use malware to infiltrate the network. These are all very real and very serious threats to every company—and the fact that there’s such a widespread lack of knowledge is unquestionably troubling.

Of course, it’s not only about numbers. What we’re learning is that there’s still a major disconnect between IT-specific functions and the rest of the enterprise, and that’s a big problem. The right technologies and related assets—data, skills, processes and more—can propel every organization to new heights, yet even a tiny vulnerability can be exploited by hackers so effectively that it devastates the brand and the bottom line. This is what makes the CISO role so important, and so stressful-it’s intricately intertwined with all other operations, yet also an island unto itself.

The disengagement can have problematic consequences. Given the frequency of headlines about data breaches, is the IT security function adequately funded? A staggering 90% of CISOs believe they lack at least one resource needed to defend against a cyberattack, and 59% believe they lack advanced technology. That’s one reason why nearly 70% report finding malware hidden on their networks for extended periods, even up to a year.

On a related note, 60% of these security specialists say they feel the board understands the inevitability of a breach, but a third still expect to be fired or disciplined if and when that happens. And even apart from the knowledge gaps, there’s confusion about fundamental defense protocols: 33% of CEOs say they would fire the person responsible for a data breach, but it’s an open question who needs to handle that; 35% believe the CEO should manage the response, while 32% say it’s the CISO.

That’s the backdrop for these findings:

  • 91% of CISOs suffer moderate or high stress
  • 60% rarely disconnect from their jobs
  • 25% say the job has affected their health and personal relationships
  • Nearly 17% medicate or use alcohol to deal with job stress
  • Less than a third stay in the job for more than three years

Again, the numbers serve only to illustrate very real problems. Stepping back from the statistics, we can identify some macro trends driving this turmoil. First, the expanding technology universe—more devices, apps, channels and capabilities—represent a much larger attack surface, and it’s only going to keep growing. Next, it’s a mistake to believe that the innovation we see on the part of the good guys isn’t matched by the sophistication of those on the other side with resources to match. Finally, there’s the sheer volume—every day we see new threat vectors carrying greater dangers. This is a moving target, and it’s moving fast.

Allocating more resources to IT security is part of the solution (more than half the executives questioned suffer from inadequate budgets) and it would also help to find more qualified people to staff security positions, which is a problem now. Having a security specialist on the management team could make a huge difference—right now, 70% say they want one, 6% say they have one. This alone would elevate security concerns inside the boardroom and perhaps persuade executives to heed warnings from the IT security department.

However, those are merely symptoms; the only way to address the true disease is by initiating a cultural change in the executive suite. Cyber security is not a standalone function that just happens to need more money or skills, or attention; it’s a strategic and business-critical priority that must be integrated into every other function rather than be assigned only to the CISO. That will usher greater knowledge into the boardroom, accelerate necessary policies and enforcement throughout the enterprise and secure all business operations. It would be nice if that transformation took place before the next massive breach.


Have you read?

# The World’s Top 100 Most Successful Unicorns, 2019.
# GDP Rankings Of The World’s Largest Economies, 2019.
# Most Expensive Countries In The World To Live In, 2019.
# Countries With The Highest Average Life Expectancies In 2030.


Add CEOWORLD magazine to your Google News feed.
Follow CEOWORLD magazine headlines on: Google News, LinkedIn, Twitter, and Facebook.

This report/news/ranking/statistics has been prepared only for general guidance on matters of interest and does not constitute professional advice. You should not act upon the information contained in this publication without obtaining specific professional advice.
No representation or warranty (express or implied) is given as to the accuracy or completeness of the information contained in this publication, and, to the extent permitted by law, CEOWORLD magazine does not accept or assume any liability, responsibility or duty of care for any consequences of you or anyone else acting, or refraining to act, in reliance on the information contained in this publication or for any decision based on it. This publication (and any extract from it) must not be copied, redistributed or placed on any website, without CEOWORLD magazine' prior written consent.


Copyright 2024 The CEOWORLD magazine. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed. For media queries, please contact: info@ceoworld.biz
SUBSCRIBE NEWSLETTER
CEOWORLD magazine - Latest - CEO Advisory - Executives need to learn more about security to combat cyber threats
Russell Haworth
Russell Haworth, is CEO of NBS, a construction technology platform. He’s a technology focused leader, with a proven track record of growing businesses with new products in new markets. His specialism is optimizing the intersect of data, cloud and machine learning for SaaS products.

Russell has a successful track record of growing businesses across multiple sectors – ranging from FinTech to Cyber Security by leveraging software, information and data analytics. Previously he was CEO of Nominet, the UK internet domain registry and cyber security company. In addition to his extensive operational experience, he has a strong background in M&A, having worked on 30+ deals over his career Beyond the day job, Russell’s a non-executive board member and advisor to a number of tech industry firms. He’s a father of two teenage boys and is a strong advocate of internet safety and has supported multiple charities to tackle this challenge.


Russell Haworth is an opinion columnist for the CEOWORLD magazine. You can follow him on LinkedIn. For more information, visit the author’s website.