This is the debut post from Coretelligent’s Chief Information Security Officer (CISO), Jason Martino. Jason will be regularly sharing his thoughts about information security on the Coretelligent blog.
With the shift towards security as a business priority, the role of the Chief Information Security Officer (CISO) has expanded and gained prominence within corporate structures. CISOs have long been the subject matter experts on cybersecurity best practices, but as the threat landscape has changed, so too has the position in the ongoing effort to protect company assets and manage risk management.
As the CISO of Coretelligent, I am responsible for our internal cybersecurity and compliance programs. I function as a conduit between IT and business and weigh in on IT and non-IT decisions, ranging from access control reviews and vendor selection to mergers and acquisitions. I also educate staff and customers on their roles in this increasingly dangerous threat environment.
At Coretelligent, we understand the risk of an inadequate security posture. Our C-suite appreciates and values the expertise of its information security professionals in evaluating and mitigating risks and connecting them to business objectives. Unfortunately, in my experience, I have seen too many businesses that do not give their security team a seat at the table. From my perspective, those businesses are still thinking of IT security as a cost center and not a revenue center. This approach is out of step with today’s reality of protecting assets in addition to a company’s reputation and brand.
To persuade any executives who need convincing, here are three takeaways that every CISO wishes their executives would better understand about information security and its role within risk management.
3 Things Your CISO Wants You to Know About Cybersecurity and Risk Management
1. Cybersecurity is About Risk Management and Not the Sole Responsibility of IT
Treat cyber risks as a risk-management issue and not solely as an IT function. Facing increased cyber threats, companies must address cyber risk in a business context or face dire consequences, including lost revenue, loss of critical data, reputational damage, compliance fines and penalties, and even the complete failure of the business. Therefore, risk needs to be identified and reduced to an acceptable level as guided by the company’s risk tolerance.
Companies must seek out and mitigate cyber risk on many levels and integrate cyber risk management throughout the organization. Unfortunately, when some executives think about information security, they mistakenly consider it a function of the IT team. But information security and information technology require different skillsets and involve entirely different responsibilities.
2. Prioritize and Practice Policy
Given the opportunity to assess hundreds of companies’ policies, I’ve realized that most companies treat policy as a checkbox activity. However, policy is more powerful than you realize.
Essentially cybersecurity is everyone’s responsibility, but executive buy-in is critical in successfully implementing an effective strategy. Executive buy-in is the crucial first step in aligning business objectives to policy and eventually to practice.
Second, creating policy shapes behavior to manage obligations and mitigate risks. Policies explain requirements for specific processes and the responsible parties involved. Keep content at a high level to avoid overloading policies with best practices, procedures, and other details that will overwhelm non-experts. Policies should be clear and achievable, setting the tone for behavior and expectations.
3. Focus on the Basics
If my inbox is any indication, there is an endless amount of vendors that claim their product or service will make your business more secure. While that may be true in some cases, it is critical to start with a good foundation. Just like you cannot decide to learn a language and become fluent overnight, focus on the fundamentals when mitigating risk. Advanced security products, services, and techniques will not be effective if you do not first build a solid foundation.
Asset management is the beginning of any security journey. To that end, create an inventory of your organization’s IT infrastructure and data and repeat this process continuously. You cannot protect an asset or confidential data if you do not know it exists. This process will allow you to understand your risk exposure. Additionally, an inventory is necessary for knowing where, when, and how to implement security patching versus functional patching.
Not all data is created equal. A one-size-fits-all approach to data protection just does not work in today’s data-driven business landscape. To that end, a tiered approach to protecting data may be more effective than blanket coverage. For example, consider who needs access, data storage and recovery costs, compliance requirements, and other parameters in determining your organization’s strategy. However, it is imperative that you identify and protect the crown jewels—the data assets that generate the most value for your company—and develop a plan that provides the best coverage for those assets.
Once you have a clear outline of your assets, the next step is to perform a risk assessment. Just as all data is not created equal, not all risks are equivalent. This exercise will enable your organization to identify and prepare for the most critical threats.
A critical component of any risk assessment involves identifying threats and vulnerabilities to IT assets. This step connects your inventory to the associated risks and allows your organization to develop a roadmap to mitigate those risks. A useful tool in completing this task is a risk heat map. A risk heat map is a data visualization tool that can help identify, prioritize, and communicate your risk exposure. In addition, it can highlight where best to allocate resources to mitigate risk.
Mitigating Risk Management
I have no doubt that there is more that your organization’s CISO would like to share with you. So, reach out to them and to our experts here at Coretelligent to learn more about protecting your business and mitigating your risk.
About Jason
Jason Martino is passionate about the intersection of security and compliance. He is responsible for Coretelligent’s internal cybersecurity programs, governance, risk, compliance activities, and educating staff and customers on an ever-evolving threat landscape.
