Board-level Cyber Literacy Is Low, Discomfort High

If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies exposed to significant risks.

The heightened level of attention to the proliferation of cyber-attacks has yielded many outcomes, but none more notable than the recognition that responsibility for cyber risks no longer lies solely within the realm of IT. 

It now sits squarely in the domain of the C-suite and business leaders, with responsibility for oversight of management’s performance in cyber-risk identification, defense, mitigation, and response resting with the corporate board of directors.

The US National Association of Corporate Directors (NACD) has been a leading voice advocating for board-level cyber risk oversight since the initial release of the NACD Director's Handbook on Cyber-Risk Oversight in 2014. 

The handbook was the first non-government resource to be featured on the US Department of Homeland Security’s US-CERT C3 Voluntary Program website. Along with providing guidance for directors in companies of all sizes and sectors, the handbook helps boards understand management's responsibilities around cyber preparedness and, more pointedly, provides questions directors should be asking of the senior executive team. 

Board-level Cyber Literacy is Low, Discomfort High

NACD's most recent annual governance survey of public-company directors highlights the ongoing discomfort board members experience when it comes to cyber literacy.

According to the survey, only 19% of directors believe they have a high-level understanding of the risks associated with cyber-security, and 59% find it difficult to oversee those risks. 

These statistics speak to a larger problem: cyber-security needs to be prioritised and approached holistically as an organisation. The reason for this is simple. Cyber risks have an impact well beyond technology: they affect new business plans, product and service offerings, mergers and acquisitions, supply chain and purchasing decisions, major capital investment decisions such as facility expansions and upgrades, R&D processes, and HR policies. 

For that reason, cyber-security should be woven into boardroom discussions on all of these topics. If business leaders and directors continue to view cybersecurity as mainly a matter for the IT department, they will leave their companies, and, in turn, the U.S. economy, exposed to significant risks.

As part of the effort to strengthen investor trust and public confidence in board-level cyber risk oversight practices, NACD has created the first credentialed course dedicated to board member cyber literacy. 

The program is a first-of-its-kind online course that goes in-depth on issues such as cyber-security leadership, effective security structure, and the role of the board. Leaders who complete the course and pass the exam earn the CERT Certificate in Cybersecurity Oversight, issued by Carnegie Mellon.

Securities and Exchange Commission leaders have called cyber-security "the biggest risk to the financial system," also noting that "boards that choose to ignore, or minimise the importance of cyber-security oversight responsibility, do so at their own peril."

A common saying in the security world is that "there are only two types of organisations: those that have experienced a breach, and those who aren't aware that they've been breached." 

While no organisation is 100% protected, the board plays an important role in assessing a company's cyber preparedness. The intent of the NACD Cyber-Risk Oversight Program is not to turn board members into technologists; it's to ensure the board is aligned with management in setting the company’s cyber risk profile, and maintaining the organisation's cyber resiliency. 

Cyber Risk Oversight

In the past 20 years, the nature of corporate asset value has changed significantly, shifting away from the physical and to- ward the virtual. One recent study found that 80 percent of the total value of the Fortune 500 now consists of intellectual property (IP) and other intangibles. 

A rapidly evolving Cyber-Threat landscape 

As recently as a few years ago, cyber-attacks were largely the province of hackers and a few highly sophisticated individuals. While problematic, many corporations could chalk up these events as simply a frustrating cost of doing business. 

Today, corporations are subject to attackers who are part of ultra-sophisticated teams that deploy increasingly targeted malware against systems and individuals in multi-staged, stealthy attacks. ese attacks, sometimes referred to as APTs (for advanced persistent threats), were first deployed against government entities and defense contractors. More recently, they have migrated throughout the economy, meaning that virtually any company is at risk.

One of the defining characteristics of these attacks is that they can penetrate virtually all of a company’s perimeter defense systems, such as firewalls or intrusion detection systems: intruders look at multiple avenues to exploit all layers of security vulnerabilities until they achieve their goal. 

In other words, if a sophisticated attacker targets a company’s systems, they will almost certainly breach them. 

Dark Reading:      IIA

Directors Report January 2017. Cyber Security Checklist For Management (£)

Cyber Security Myths for SMEs (£):

 

« Drones For Rail & Road Tunnel Inspections
WikiLeaks Dump Shines Light On US Intelligence’s Zero-Day Policy »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CircleCI

CircleCI

CircleCI’s platform allows developers to rapidly release code (for web and mobile apps) they trust by automating the build, test, and deploy process.

Thermo Systems

Thermo Systems

Thermo Systems is a design-build control systems engineering and construction firm. Capabilties include industrial control system cybersecurity.

SecurityScorecard

SecurityScorecard

SecurityScorecard provides the most accurate security ratings & continuous risk monitoring for vendor and third party risk management.

ThreatMark

ThreatMark

ThreatMark provides fraud detection solutions for digital banking and payments.

Emsisoft

Emsisoft

Emsisoft protects your devices against all types of malware, ransomware and other threats with no-bloat anti-malware & antivirus solutions.

Romanian Accreditation Association (RENAR)

Romanian Accreditation Association (RENAR)

RENAR is the national accreditation body for Romania. The directory of members provides details of organisations offering certification services for ISO 27001.

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

GCSCC's work is focused on developing a framework for understanding what works, what doesn’t work and why – across all areas of cybersecurity capacity.

Cyber Smart Defense

Cyber Smart Defense

Cyber Smart Defense is a specialist provider of penetration testing services and IT security audits.

eXate

eXate

eXate provides pioneering technology that empowers organisations to protect, control and manage their sensitive data centrally, providing a complete data privacy solution.

AirEye

AirEye

AirEye is a leader in Network Airspace Protection (NAP). Block attacks against your corporate network launched from wireless devices in your corporate network airspace.

Reliance Cyber

Reliance Cyber

Reliance Cyber (formerly Reliance ACSN) help to monitor and manage your organisation’s security infrastructure 24/7, so you can make sure all threats and issues are dealt with.

Nexon Asia Pacific

Nexon Asia Pacific

Nexon solutions include cloud infrastructure and services, unified communications, managed security services, business continuity, secured high-performance network and business applications.

Gen Digital

Gen Digital

At Gen™, our mission is to create technology solutions for people to take full advantage of the digital world, safely, privately, and confidently – so together, we can build a better tomorrow.

Millennium Corporation

Millennium Corporation

For nearly two decades, Millennium Corporation has been operating on the leading edge of cybersecurity.

Knowit

Knowit

Knowit support customers in the digital transformation, simplify people’s everyday lives and create secure and innovative solutions enabling a sustainable future.

Attestiv

Attestiv

Attestiv puts authenticity into photos, videos and documents by utilizing advanced technologies in AI and tamper-proofing.