Technology & Innovation

The language of cyber security

October 05, 2016

Global

October 05, 2016

Global
Kim DeCarlis

Chief Marketing Officer

Kim DeCarlis has served as Imperva’s Chief Marketing Officer since October 2014, where she is responsible for the entire marketing spectrum, including corporate marketing, communications, demand generation, product marketing and marketing operations. Kim previously led the worldwide marketing organisation at BMC. Prior to that, she spent five years as the VP of Corporate Marketing at Citrix. Her experience also includes SVP of Product Marketing at Information Resources, Inc. (IRI), as well as marketing and sales roles at growth–oriented technology companies including Saba, Documentum, Xerox, and IBM. 
Kim served on the Board of Directors for Watermark from April 2012 to October 2015 and actively volunteers for local community organisations. She is a graduate of Stanford University with a bachelor’s degree in industrial engineering.

Grasping the cyber security issue head-on – and not just via a bullet point or two – is critical.

Cyber security threats are a chief concern for a growing number of corporate boards. Directors and senior management worry that data breaches and thefts could damage their company’s growth prospects, bottom line and brand reputation. Increasingly, boards seek to ensure that strong programs are in place to respond to any incident and that their chief information security officers (CISOs) brief them regularly on cyber security.

Talking the talk

Directors have a fiduciary responsibility to protect the company they serve but with cyber security-related litigation increasing, lawmakers and regulators seem primed to toughen their oversight.

While company boards recognise that it is both management’s and the CISO’s responsibility to protect a company’s data and applications, they must ensure that they communicate in the most effective way with their IT experts. Often, they don’t. A vast majority of directors are not tech-savvy and many CISOs don’t speak the language of business. Both boards and IT security professionals must discard their professional and technical lingo and speak plainly to one another.

In conversations with directors and IT leaders, it’s clear that this is a common occurrence: A CISO briefing the board will suddenly lapse into using IT jargon – an alphabet soup of terms from “asymmetric cryptography” to “zombie.” Directors, on the other hand, too often speak the language of an economist or an MBA.

What CISOs must realize is that directors want to know in plain terms the financial impact that a technology issue – whether a breach or an IT security expenditure – will have. They want to know what it will mean if the company doesn’t give IT more security personnel or budget to advance their cyber security portfolio. At the same time, CISOs must be able to follow a boardroom conversation.

Advice for both sides

There are a number of ways in which both sides can tackle the complexities of cyber security.

For Directors:

  • Do homework on the basics of information breaches and cyber security. Gain enough knowledge to be able to grasp what IT leaders are saying and to ask pertinent questions. This background information can come from other board members who have more experience on the topic, from security-related websites or from news outlets that regularly cover the steady drumbeat of breaches.
  • Find out the common ways cyber criminals, spies and hacktivists burrow into a target’s IT infrastructure and extract critical data, as they did in the high-profile breaches that compromised Anthem, Home Depot, Neiman Marcus, Sony and Target.
  • Ask for and review what peers are doing in the company’s industry, and keep an eye on the company’s competitors and their security postures.
  • Grasp the compliance issues that affect or could impact the company in the areas of security and privacy. A legal or government affairs resource in the company should be able to supply that.
  • Refrain from asking a CISO a binary question such as “Are we secure?” It’s unrealistic to think that any company can ever achieve a zero-risk state. There’s no guarantee a data breach will never occur. Instead, ask “Can major cyber threats be mitigated? Do we align with industry security practices? Are we in compliance with regulations and industry standards? How did we do in our last cyber incident response simulation?”  

For CISOs:

  • Since a board presentation can trigger panic – and even kill a project or hurt a career if done poorly – look to experts such as industry analysts for guidance and download resources such as the Gartner Executive Briefing Toolkit for Security Strategy. 
  • Think strategically and focus on the business, which means forego tech speak and relate the value of, for example, a technology security purchase to risk mitigation, not ROI or TCO. For board members, risk tolerance, risk mitigation, brand reputation, business disruption and compliance are key.

In the end, much of the responsibility for effective communication rests with the CISO. But directors also have an obligation to ensure that a dialogue is open, honest and generates important and insightful knowledge.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week