Board-level Cyber Literacy Is Low, Discomfort High

If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies exposed to significant risks.

The heightened level of attention to the proliferation of cyber-attacks has yielded many outcomes, but none more notable than the recognition that responsibility for cyber risks no longer lies solely within the realm of IT. 

It now sits squarely in the domain of the C-suite and business leaders, with responsibility for oversight of management’s performance in cyber-risk identification, defense, mitigation, and response resting with the corporate board of directors.

The US National Association of Corporate Directors (NACD) has been a leading voice advocating for board-level cyber risk oversight since the initial release of the NACD Director's Handbook on Cyber-Risk Oversight in 2014. 

The handbook was the first non-government resource to be featured on the US Department of Homeland Security’s US-CERT C3 Voluntary Program website. Along with providing guidance for directors in companies of all sizes and sectors, the handbook helps boards understand management's responsibilities around cyber preparedness and, more pointedly, provides questions directors should be asking of the senior executive team. 

Board-level Cyber Literacy is Low, Discomfort High

NACD's most recent annual governance survey of public-company directors highlights the ongoing discomfort board members experience when it comes to cyber literacy.

According to the survey, only 19% of directors believe they have a high-level understanding of the risks associated with cyber-security, and 59% find it difficult to oversee those risks. 

These statistics speak to a larger problem: cyber-security needs to be prioritised and approached holistically as an organisation. The reason for this is simple. Cyber risks have an impact well beyond technology: they affect new business plans, product and service offerings, mergers and acquisitions, supply chain and purchasing decisions, major capital investment decisions such as facility expansions and upgrades, R&D processes, and HR policies. 

For that reason, cyber-security should be woven into boardroom discussions on all of these topics. If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies, and, in turn, the U.S. economy, exposed to significant risks.

As part of the effort to strengthen investor trust and public confidence in board-level cyber risk oversight practices, NACD has created the first credentialed course dedicated to board member cyber literacy. 

The program is a first-of-its-kind online course that goes in-depth on issues such as cyber-security leadership, effective security structure, and the role of the board. Leaders who complete the course and pass the exam earn the CERT Certificate in Cybersecurity Oversight, issued by Carnegie Mellon.

Securities and Exchange Commission leaders have called cyber-security "the biggest risk to the financial system," also noting that "boards that choose to ignore, or minimise the importance of cyber-security oversight responsibility, do so at their own peril."

A common saying in the security world is that "there are only two types of organisations: those that have experienced a breach, and those who aren't aware that they've been breached." 

While no organisation is 100% protected, the board plays an important role in assessing a company's cyber preparedness. The intent of the NACD Cyber-Risk Oversight Program is not to turn board members into technologists; it's to ensure the board is aligned with management in setting the company’s cyber risk profile, and maintaining the organisation's cyber resiliency. 

Cyber Risk Oversight

In the past 20 years, the nature of corporate asset value has changed significantly, shifting away from the physical and to- ward the virtual. One recent study found that 80 percent of the total value of the Fortune 500 now consists of intellectual property (IP) and other intangibles. 

A rapidly evolving Cyber-Threat landscape 

As recently as a few years ago, cyber-attacks were largely the province of hackers and a few highly sophisticated individuals. While problematic, many corporations could chalk up these events as simply a frustrating cost of doing business. 

Today, corporations are subject to attackers who are part of ultra-sophisticated teams that deploy increasingly targeted malware against systems and individuals in multi-staged, stealthy attacks. ese attacks, sometimes referred to as APTs (for advanced persistent threats), were first deployed against government entities and defense contractors. More recently, they have migrated throughout the economy, meaning that virtually any company is at risk.

One of the defining characteristics of these attacks is that they can penetrate virtually all of a company’s perimeter defense systems, such as firewalls or intrusion detection systems: intruders look at multiple avenues to exploit all layers of security vulnerabilities until they achieve their goal. 

In other words, if a sophisticated attacker targets a company’s systems, they will almost certainly breach them. 

Dark Reading:      IIA

Directors Report January 2017. Cyber Security Checklist For Management (£)

Cyber Security Myths for SMEs (£):

 

« Drones For Rail & Road Tunnel Inspections
WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Morgan Lewis Law

Morgan Lewis Law

Morgan Lewis is an international law firm with offices in North America, Europe, Asia, and the Middle East. Practice areas include Privacy and Cybersecurity.

Dome9

Dome9

Dome9 is a cloud firewall management service that stops vulnerabilities, secures remote access, and centralizes policy management.

Snow Software

Snow Software

Snow Software is changing the way organizations think about their technology investments, empowering IT and business leaders to drive transformation with precision and agility.

European Network for Cyber Security (ENCS)

European Network for Cyber Security (ENCS)

ENCS’s core focus is around educating and solving cyber security challenges in the development and operation of energy grids across Europe.

SQNetworks

SQNetworks

SQNetworks provides a full range of cybersecurity consultancy, services and solutions.

Vector InfoTech

Vector InfoTech

Vector InfoTech is a leader in Industrial Security, Networks, IT and Telecommunications.

National Cyber Security Centre (NCSC) - New Zealand

National Cyber Security Centre (NCSC) - New Zealand

The role of the NCSC is to help New Zealand’s most significant public and private sector organisations to protect their information systems from advanced cyber-borne threats.

iONLINE

iONLINE

iONLINE delivers high quality IT services and solutions to businesses in Azerbaijan.

International Data Sanitization Consortium (IDSC)

International Data Sanitization Consortium (IDSC)

IDSC is a group composed of individuals and companies dedicated to standardizing terminology and practices across the data sanitization industry.

Quantstamp

Quantstamp

Quantstamp are experts in Smart Contract Security Audits. We provide verification that your decentralized system works as intended.

Argo Group

Argo Group

Argo is an international underwriter of specialty insurance. Argo Cyber offers a full spectrum of coverage solutions related to professional and technology services.

US Cyber Range

US Cyber Range

US Cyber Range is a scalable, cloud-hosted infrastructure providing students with virtual environments for realistic, hands-on cybersecurity labs and exercises.

Suridata

Suridata

Suridata’s SaaS Security platform enables organizations to secure the use of SaaS applications.

BrainStorm

BrainStorm

BrainStorm Threat Defense takes a new human-focused approach to security awareness that traditional training lacks. It’s a cutting-edge platform to make your users more security savvy.

Kralos

Kralos

Kralos are an experienced team of Software and IT experts, specialized in the development of innovative cybersecurity solutions.

M.Tech

M.Tech

M.Tech is a leading cyber security and network performance solutions provider. We work with leading vendors to bring optimal solutions to the market through a channel of reseller partners.