The conversations boards should have about cybersecurity
GUEST OPINION: Phishing attacks, malware, social engineering, spear phishing, and credential stuffing are all cyber threats that have one alarming trait in common. They are now more rampant than ever, leaving Australian organisations at the mercy of their relentless and sophisticated tactics. This is why board members need to be more than just decision-makers; they need to be informed participants in cybersecurity discussions.
Jason Whyte, general manager for Asia Pacific, Trustwave, said, “Traditionally, board members have typically been less technical-oriented, making it challenging for them to fully grasp the complexities associated with cybersecurity risks with their role primarily involving high-level decision-making rather than delving into the specifics of technical implementations or audits.
“In contrast, chief information security officers (CISOs) excel in the technical aspects of cybersecurity, being closely attuned to IT staff and the measures required to keep data safe. This difference in focus is natural, given the distinct roles of board members and CISOs in a company.”
However, given the current threat landscape and the potential repercussions of a cyberattack, CISOs now need to work with the board to help them understand cyber risks and ensure cybersecurity concerns are addressed promptly. There are three essential conversations that every business should have right now:
- Strengthening the CISO-board relationship
To bridge the cybersecurity knowledge gap, it’s crucial that a CISO fosters a collaborative relationship with their board. Clear, straightforward communication is key. This should include discussions on risk prioritisation, budget optimisation, and investment in proactive security tools. CISOs need to ensure the seriousness of cyber threats and the necessary response to mitigate them is conveyed in a way that resonates with board members.
- Reframing cybersecurity as a strategic investment
Cybersecurity isn’t just another line item in the budget; it’s an investment in an organisation’s future. Historically, cybersecurity budgets have been perceived as costs rather than strategic investments. Yet, it’s important to treat cybersecurity spending with the same scrutiny applied to any other business investment. Assess its return on investment (ROI) in terms of financial return along with how well it protects the company from operational disruptions and reputational damage. Comparable to insurance, the immediate benefits may not be apparent; however, it’s true value becomes evident when the need arises.
- Adapting to emerging cybersecurity trends
Emerging trends in the cybersecurity landscape, such as the integration of artificial intelligence (AI) and automation, add layers of complexity. These technologies, while enhancing threat detection and response capabilities, also require strategic implementation to align with overall cybersecurity objectives. Similarly, the complexity of modern supply chains calls for robust security measures. Each component of the supply chain is akin to a link in a chain, where a breach in any part can compromise the entire system. Continuous risk monitoring and management are crucial in maintaining the security integrity of these interconnected systems.
Greater regulations for connected and embedded devices, particularly Internet of Things (IoT) devices, are also an emerging trend due to their vulnerability to cyberattacks. These devices, often lacking robust built-in security, can be potential entry points for cyber threats. Safeguarding their security—through continuous risk monitoring and management—is essential to mitigate vulnerabilities that could be exploited by cybercriminals.
Jason Whyte said, “In 2024, CISOs need to transition from technical experts to strategic executive leaders. Their responsibilities now extend beyond traditional cybersecurity oversight to aligning cybersecurity strategies with business objectives, ensuring regulatory compliance, and fostering a security-first culture within the organisation.
“Integrating cybersecurity into business strategy is a multifaceted challenge that requires a balanced approach combining technical expertise, strategic business understanding, and effective communication. The collaboration between a CISO and their board members, underpinned by ongoing dialogue and mutual learning, is essential in managing cybersecurity risks and ensuring the long-term resilience and success of the company.”
