Insights: Article

Cyber from the Break Room to the Board Room

By   Jon Ault

February 25, 2017

The theme for this year’s FBI National Cybersecurity Awareness Month (NCSAM)  is “Our Shared Responsibility”.  All too often, cybersecurity is viewed as an “IT problem”; however, the most effective cybersecurity programs rely on much more than technical solutions to protect an organization’s information.  In today’s environment, cybersecurity is truly a shared responsibility, across all people, processes and technology controls.  Everyone in the organization, from the break room to the board room, has a critical role to play.

Board Room Roles
According to a recent report from Taniam & Nasdaq only 10% of the high vulnerable board members felt that they were regularly updated on cybersecurity risks for their business.  (The Accountability Gap: Cybersecurity & Building a Culture of Responsibility).  The list of risks and concerns for a board seem endless; however, it is important to understand the proper roles for a board in managing cybersecurity risk:

  • Prioritize – Directing management to give cybersecurity the appropriate attention sets the tone for the entire organization.
  • Assess – Expect the organization to complete a formal assessment of cybersecurity risks, utilizing outside experts and following guidance from a proven risk assessment framework.  (Examples:  NIST 800-53 or SANS 20 Critical Controls)
  • Monitor – Establish expectations that the board will be updated on cybersecurity risk management updates on a regular basis.

 
Executive Roles
Executive management plays a critical role in establishing day-to-day priorities for an organization’s cybersecurity efforts.  Establishing cybersecurity as a critical function within the organization and assigning appropriate resources (people and budget) are critical first steps for executive management.  Specifically, executive management should take responsibility for the following in their cybersecurity risk management program:

  • Organize – Assign responsibility for coordinating your cybersecurity efforts and build security into your day-to-day processes.
  • Communicate – Act as a champion for your organization’s cybersecurity efforts.  When staff see that executive management has made cybersecurity a priority, it will naturally become a priority for everyone.
  • Prepare – Cybersecurity risk management programs are not complete if you don’t have plans in place to respond to an incident or breach in your environment.

 
Staff Roles
The list of cybersecurity threats targeting people (not technology) vulnerabilities is growing.  Everyone in an organization need to do their part to reduce the risks against phishing emails, spyware, ransomware and every other threat to an organization’s critical information assets.  Key strategies for reducing social engineering and staff-related risks across your organization include:

  • Training – Attend all available staff training events on acceptable use of company computers and resources.
  • Awareness – Pay attention to news stories about cyber-crime.  Often times just simply knowing about the latest attack methods can change an individual’s behavior and reduce risk.
  • Confirm – Think before opening attachments or clicking on links in emails, especially when they are from unsolicited sources.

As you can see, everyone in an organization plays a critical role in the cybersecurity risk management strategy.  Cybersecurity is not simply an “IT problem” and, as the NCSAM theme says cybersecurity is clearly “our shared responsibility”.  The best risk management programs take into account the right roles & responsibilities for everyone in your organization.

Latest Insights

July 19, 2018
Article
While it’s great to watch your team grow, hiring new employees can be a frustrating and grueling process.
July 19, 2018
Article
Often, human resources (HR) is over looked, but we’re here to tell you it’s an essential component of any organization and critically important to get right.
July 13, 2018
Article
Here are some idea for giving your new hire a smooth start into your business and alleviating stress for you.
July 13, 2018
Article
The impact of the recent SCOTUS Wayfair decision will continue to have a ripple effect on businesses and state sales tax compliance.
July 9, 2018
Article
The revenue cycle is a complex system and we have historically given much attention to the front-end and back-end while oftentimes leaving the middle functions of the cycle neglected.
July 3, 2018
Article
FASB Accounting Standards Codification Topic 606, Revenue from Contracts with Customers, provides a 5-step framework for determining revenue recognition.
July 2, 2018
Article
As part of the Tax Reform Act of 1986, the “Kiddie tax,” a taxing regime designed to make the transfer of income items by wealthy parents to lower tax paying children less attractive, was implemented.
July 2, 2018
Article
When it comes to your employees, you likely conducted interviews on them when you first hired them.
July 2, 2018
Article
Nearly ten years after the release of the initial exposure draft, FASB issued ASU 2016-02, Leases - The standard may have been issued, but the conversation about this re-write of legacy guidance has not slowed.