Board-level Cyber Literacy Is Low, Discomfort High

If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies exposed to significant risks.

The heightened level of attention to the proliferation of cyber-attacks has yielded many outcomes, but none more notable than the recognition that responsibility for cyber risks no longer lies solely within the realm of IT. 

It now sits squarely in the domain of the C-suite and business leaders, with responsibility for oversight of management’s performance in cyber-risk identification, defense, mitigation, and response resting with the corporate board of directors.

The US National Association of Corporate Directors (NACD) has been a leading voice advocating for board-level cyber risk oversight since the initial release of the NACD Director's Handbook on Cyber-Risk Oversight in 2014. 

The handbook was the first non-government resource to be featured on the US Department of Homeland Security’s US-CERT C3 Voluntary Program website. Along with providing guidance for directors in companies of all sizes and sectors, the handbook helps boards understand management's responsibilities around cyber preparedness and, more pointedly, provides questions directors should be asking of the senior executive team. 

Board-level Cyber Literacy is Low, Discomfort High

NACD's most recent annual governance survey of public-company directors highlights the ongoing discomfort board members experience when it comes to cyber literacy.

According to the survey, only 19% of directors believe they have a high-level understanding of the risks associated with cyber-security, and 59% find it difficult to oversee those risks. 

These statistics speak to a larger problem: cyber-security needs to be prioritised and approached holistically as an organisation. The reason for this is simple. Cyber risks have an impact well beyond technology: they affect new business plans, product and service offerings, mergers and acquisitions, supply chain and purchasing decisions, major capital investment decisions such as facility expansions and upgrades, R&D processes, and HR policies. 

For that reason, cyber-security should be woven into boardroom discussions on all of these topics. If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies, and, in turn, the U.S. economy, exposed to significant risks.

As part of the effort to strengthen investor trust and public confidence in board-level cyber risk oversight practices, NACD has created the first credentialed course dedicated to board member cyber literacy. 

The program is a first-of-its-kind online course that goes in-depth on issues such as cyber-security leadership, effective security structure, and the role of the board. Leaders who complete the course and pass the exam earn the CERT Certificate in Cybersecurity Oversight, issued by Carnegie Mellon.

Securities and Exchange Commission leaders have called cyber-security "the biggest risk to the financial system," also noting that "boards that choose to ignore, or minimise the importance of cyber-security oversight responsibility, do so at their own peril."

A common saying in the security world is that "there are only two types of organisations: those that have experienced a breach, and those who aren't aware that they've been breached." 

While no organisation is 100% protected, the board plays an important role in assessing a company's cyber preparedness. The intent of the NACD Cyber-Risk Oversight Program is not to turn board members into technologists; it's to ensure the board is aligned with management in setting the company’s cyber risk profile, and maintaining the organisation's cyber resiliency. 

Cyber Risk Oversight

In the past 20 years, the nature of corporate asset value has changed significantly, shifting away from the physical and to- ward the virtual. One recent study found that 80 percent of the total value of the Fortune 500 now consists of intellectual property (IP) and other intangibles. 

A rapidly evolving Cyber-Threat landscape 

As recently as a few years ago, cyber-attacks were largely the province of hackers and a few highly sophisticated individuals. While problematic, many corporations could chalk up these events as simply a frustrating cost of doing business. 

Today, corporations are subject to attackers who are part of ultra-sophisticated teams that deploy increasingly targeted malware against systems and individuals in multi-staged, stealthy attacks. ese attacks, sometimes referred to as APTs (for advanced persistent threats), were first deployed against government entities and defense contractors. More recently, they have migrated throughout the economy, meaning that virtually any company is at risk.

One of the defining characteristics of these attacks is that they can penetrate virtually all of a company’s perimeter defense systems, such as firewalls or intrusion detection systems: intruders look at multiple avenues to exploit all layers of security vulnerabilities until they achieve their goal. 

In other words, if a sophisticated attacker targets a company’s systems, they will almost certainly breach them. 

Dark Reading:      IIA

Directors Report January 2017. Cyber Security Checklist For Management (£)

Cyber Security Myths for SMEs (£):

 

« Drones For Rail & Road Tunnel Inspections
WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Mobile Guroo

Mobile Guroo

Mobile Guroo is a strategy and systems integrator for Enterprise Mobility Management projects.

Micro Focus

Micro Focus

Micro Focus is one of the world’s largest enterprise software providers. We deliver trusted and proven mission-critical software that keeps the digital world running.

NXO France

NXO France

NXO is an independent leader in the integration and management of digital workflows with services covering digital infrastructures, communications & collaboration, and security.

Trulioo

Trulioo

Trulioo is a leading global identity and business verification company providing secure access to data sources worldwide to instantly verify consumers and businesses online.

Precise Biometrics

Precise Biometrics

Precise Biometrics develop and sell fingerprint software for convenient and secure authentication of people’s identity in mobile devices, smart cards and other products with fingerprint sensors.

SCIS Security

SCIS Security

SCIS Security provides affordable cyber security services and solutions to small to medium sized businesses and homes.

Safetica

Safetica

Safetica Technologies is a Czech software company that delivers data protection solutions for businesses of all types and sizes.

National Accreditation Authority Hungary (NAH)

National Accreditation Authority Hungary (NAH)

NAH is the national accreditation body for Hungary. The directory of members provides details of organisations offering certification services for ISO 27001.

Cyber Covered

Cyber Covered

Cyber Covered provide complete website & data cover with market leading cyber insurance and powerful compliance software in one affordable package.

AnChain.AI

AnChain.AI

AnChain.AI's analytics platform proactively protects crypto assets by providing proprietary artificial intelligence, knowledge graphs, and threat intelligence on blockchain transactions.

ERI

ERI

ERI is the largest fully integrated IT and electronics asset disposition provider and cybersecurity-focused hardware destruction company in the United States.

Cyber Readiness Institute (CRI)

Cyber Readiness Institute (CRI)

At the Cyber Readiness Institute, our mission is simple: empower small and medium-sized enterprises with free tools and resources to help them become more secure and resilient.

South East Cyber Resilience Centre (SECRC)

South East Cyber Resilience Centre (SECRC)

The South East Cyber Resilience Centre supports and helps protect SMEs and supply chain businesses and third sector organisations in the region against cyber crime.

AuditBoard

AuditBoard

AuditBoard is the leading cloud-based platform transforming audit, risk, ESG, and InfoSec management.

Seven AI

Seven AI

Seven AI develops cyber security software designed to identify online threats.

Cyber Security Certification Australia (CSCAU)

Cyber Security Certification Australia (CSCAU)

CSCAU is the world’s first 'for mission' industry council set up to address small and medium-sized business (SMB) cyber resilience through annually updated certifiable standards.

TeamSystem

TeamSystem

TeamSystem is a leading tech company in the market for digital business management solutions for companies and professionals.