Board-level Cyber Literacy Is Low, Discomfort High

If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies exposed to significant risks.

The heightened level of attention to the proliferation of cyber-attacks has yielded many outcomes, but none more notable than the recognition that responsibility for cyber risks no longer lies solely within the realm of IT. 

It now sits squarely in the domain of the C-suite and business leaders, with responsibility for oversight of management’s performance in cyber-risk identification, defense, mitigation, and response resting with the corporate board of directors.

The US National Association of Corporate Directors (NACD) has been a leading voice advocating for board-level cyber risk oversight since the initial release of the NACD Director's Handbook on Cyber-Risk Oversight in 2014. 

The handbook was the first non-government resource to be featured on the US Department of Homeland Security’s US-CERT C3 Voluntary Program website. Along with providing guidance for directors in companies of all sizes and sectors, the handbook helps boards understand management's responsibilities around cyber preparedness and, more pointedly, provides questions directors should be asking of the senior executive team. 

Board-level Cyber Literacy is Low, Discomfort High

NACD's most recent annual governance survey of public-company directors highlights the ongoing discomfort board members experience when it comes to cyber literacy.

According to the survey, only 19% of directors believe they have a high-level understanding of the risks associated with cyber-security, and 59% find it difficult to oversee those risks. 

These statistics speak to a larger problem: cyber-security needs to be prioritised and approached holistically as an organisation. The reason for this is simple. Cyber risks have an impact well beyond technology: they affect new business plans, product and service offerings, mergers and acquisitions, supply chain and purchasing decisions, major capital investment decisions such as facility expansions and upgrades, R&D processes, and HR policies. 

For that reason, cyber-security should be woven into boardroom discussions on all of these topics. If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies, and, in turn, the U.S. economy, exposed to significant risks.

As part of the effort to strengthen investor trust and public confidence in board-level cyber risk oversight practices, NACD has created the first credentialed course dedicated to board member cyber literacy. 

The program is a first-of-its-kind online course that goes in-depth on issues such as cyber-security leadership, effective security structure, and the role of the board. Leaders who complete the course and pass the exam earn the CERT Certificate in Cybersecurity Oversight, issued by Carnegie Mellon.

Securities and Exchange Commission leaders have called cyber-security "the biggest risk to the financial system," also noting that "boards that choose to ignore, or minimise the importance of cyber-security oversight responsibility, do so at their own peril."

A common saying in the security world is that "there are only two types of organisations: those that have experienced a breach, and those who aren't aware that they've been breached." 

While no organisation is 100% protected, the board plays an important role in assessing a company's cyber preparedness. The intent of the NACD Cyber-Risk Oversight Program is not to turn board members into technologists; it's to ensure the board is aligned with management in setting the company’s cyber risk profile, and maintaining the organisation's cyber resiliency. 

Cyber Risk Oversight

In the past 20 years, the nature of corporate asset value has changed significantly, shifting away from the physical and to- ward the virtual. One recent study found that 80 percent of the total value of the Fortune 500 now consists of intellectual property (IP) and other intangibles. 

A rapidly evolving Cyber-Threat landscape 

As recently as a few years ago, cyber-attacks were largely the province of hackers and a few highly sophisticated individuals. While problematic, many corporations could chalk up these events as simply a frustrating cost of doing business. 

Today, corporations are subject to attackers who are part of ultra-sophisticated teams that deploy increasingly targeted malware against systems and individuals in multi-staged, stealthy attacks. ese attacks, sometimes referred to as APTs (for advanced persistent threats), were first deployed against government entities and defense contractors. More recently, they have migrated throughout the economy, meaning that virtually any company is at risk.

One of the defining characteristics of these attacks is that they can penetrate virtually all of a company’s perimeter defense systems, such as firewalls or intrusion detection systems: intruders look at multiple avenues to exploit all layers of security vulnerabilities until they achieve their goal. 

In other words, if a sophisticated attacker targets a company’s systems, they will almost certainly breach them. 

Dark Reading:      IIA

Directors Report January 2017. Cyber Security Checklist For Management (£)

Cyber Security Myths for SMEs (£):

 

« Drones For Rail & Road Tunnel Inspections
WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy »

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Cyber Security Service Supplier Directory

Cyber Security Service Supplier Directory

Free Access: Cyber Security Service Supplier Directory listing 5,000+ specialist service providers.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Ericsson

Ericsson

Ericsson is a leading provider of telecommunications services and network infrastructure solutions including all aspects of network security.

CSI

CSI

CSI is an award-winning Application and Security Managed Service Provider offering complete solutions that include the provision of Infrastructure, Software, Professional Services and Support.

Neoteric Networks

Neoteric Networks

We deliver a no nonsense procedure to implementing technology. The technology selection process ensures that all customers enjoy an engineered methodology implementing technology.

Tata Consultancy Services

Tata Consultancy Services

Tata Consultancy Services is a global leader in IT services, consulting & business solutions including cyber security.

DOS

DOS

DOS is an Ecuadorian company with 3 decades of presence in the market and extensive experience in the planning, management and execution of IT Service Integration Projects.

CultureAI

CultureAI

CultureAI deliver intelligent cyber security awareness education and tools that build resilient security cultures where employees help defend.

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions (EPS)

Extreme Protocol Solutions is an industry leading Data Sanitization Software, Hardware and Onsite Service Provider.

Cloud Box Technologies

Cloud Box Technologies

Cloud Box Technologies is one of the premier IT Infrastructure Solution providers in the Middle East.