Essential Cybersecurity Concepts for CEOs

They know meeting objectives and delivering on business initiatives means they need to rely on information systems and the internet. That means a cyberattack could cause severe disruption to a company's business functions or operational supply chain, impact reputation, or compromise sensitive customer data and intellectual property.

Companies face a series of cyber threats some that pack such a powerful punch they need to enact a security program that goes way beyond just compliance. One Ponemon Institute study in 2011* found the average cost of a compromised record in the US was $194 per record and the loss of customer business due to a cyber breach was around $3 million.

With that in mind, the US-CERT created a document that provides key questions to help guide cybersecurity risk management for a company, along with key cyber risk management concepts.

With evolving cyber threats, chief executives are taking a new look and approach to how they deal with cybersecurity.

The Top 5 Cybersecurity Questions for CEOs

1. How is our executive leadership informed about the current level & business impact of cyber risks to our company?
2. What is the current level and business impact of cyber risks to our company? What is our plan to address identified risks?
3. How does our cybersecurity program apply industry standards d best practices?
4. How many & what types of cyber incidents do we detect in a normal week? What is the threshold for notifying our executive leadership?
5. How comprehensive is our cyber incident response plan? How often is it tested?
   
   

Important Cyber Risk Management Concepts

In addition, US-CERT listed key cyber risk management concepts:

Incorporate cyber risks into existing risk management and governance processes.

Cybersecurity isn't about implementing a checklist of requirements. It's about managing cyber risks to an acceptable level. Managing cybersecurity risk as part of an organization's governance, risk management and business continuity frameworks provides the strategic framework for managing cybersecurity risk throughout the enterprise.

Elevate cyber risk management discussions to the chief executive.

Chief executive engagement in defining the risk strategy and levels of acceptable risk enables more cost effective management of cyber risks aligned with the business needs of the organization. Regular communication between the chief executive and those held accountable for managing cyber risks provides awareness of current risks affecting their organization and associated business impact.

Implement industry standards and best practices. Don't rely on compliance.

A comprehensive cybersecurity program leverages industry standards and best practices to protect systems and detect potential problems, along with processes to understand current threats and enable timely response and recovery. Compliance requirements help to establish a good cybersecurity baseline to address known vulnerabilities, but do not adequately address new and dynamic threats, or counter sophisticated adversaries. Using a risk based approach to apply cybersecurity standards and practices allows for more comprehensive and cost effective management of cyber risks than compliance activities alone.

Evaluate and manage your organization’s specific cyber risks.

Identifying critical assets and associated impacts from cyber threats are critical to understanding a company's specific risk exposure-whether financial, competitive, reputational, or regulatory. Risk assessment results are a key input to identify and prioritize specific protective measures, allocate resources, inform long-term investments and develop policies and strategies to manage cyber risks to an acceptable level.

Provide oversight and review.

Executives are responsible for managing and overseeing enterprise risk management. Cyber oversight activities include the regular evaluation of cybersecurity budgets, IT acquisition plans, IT outsourcing, cloud services, incident reports, risk assessment results and top-level policies.

Develop and test incident response plans and procedures.

Even a well-defended organization will experience a cyber incident at some point. When network defenses end up penetrated, a chief executive should be ready to answer, "What is our Plan B?" Documented cyber incident response plans exercised regularly help to enable timely response and minimize impacts.

Even a well-defended organization will experience a cyber incident at some point. When network defenses are penetrated, a chief executive should be ready to answer, "What is our plan B?"

Coordinate cyber incident response planning across the enterprise.

Early response actions can limit or even prevent possible damage. A key component of cyber incident response preparation is planning in conjunction with the Chief Information Officer/Chief Information Security Officer, business leaders, continuity planners, system operators, general counsel and public affairs. This includes integrating cyber incident response policies and procedures with existing disaster recovery and business continuity plans.

Maintain situational awareness of cyber threats.

Situational awareness of an organization's cyber risk environment involves timely detection of cyber incidents, along with the awareness of current threats and vulnerabilities specific to that organization and associated business impacts. Analyzing, aggregating, and integrating risk data from various sources and participating in threat information sharing with partners helps organizations identify and respond to incidents quickly and ensure protective efforts are commensurate with risk.

A network operations center can provide real-time and trend data on cyber events. Business-line managers can help identify strategic risks, such as risks to the supply chain created through third-party vendors or cyber inter-dependencies. Sector information-sharing and analysis centers, government and intelligence agencies, academic institutions, and research firms also serve as valuable sources of threat and vulnerability information that can enhance situational awareness.

What key SCADA Security questions and concepts would you like to ask the head of your organization? 

*The Ponemon Institute 2012 version of their "Cost of Cyber Crime Study" is an informative document to share with senior leaders. Practical SCADA Security thanks Greg Hale & ISS Source Source for this article.

Greg Hale
Editor and Founder
ISS Source