ExtraHop Presentation: Right-Sizing Risk - How to Talk to the Board About Cybersecurity
No ratings
Presented at CyberSecuritySummitSeattle 2020 by
As enterprises have become increasingly reliant on technology for every aspect of operations, technical executives like CIOs and CISOs have found themselves in a completely new operations center: the boardroom. This shift is more recent for CISOs, who increasingly must demonstrate security and compliance at a board level. This move can present a significant challenge. Board members are often not well-versed in technology or security best practices, let alone jargon. At the same time, CISOs (and CIOs) often lack the business experience to speak in terms that the board can understand, defaulting to technical discussions that the board can’t parse.This breakdown in communication can have a cascade effect. The board might fail to fully understand the security risks posed by a certain initiative. Or, with the growing number of costly and embarrassing security breaches, they might overemphasize caution and risk mitigation at the expense of implementing important technical advancements.In this session, attendees will learn strategies for discussing security and technology priorities at the board level.Getting alignment: The board isn’t going to understand the technical nuances of why certain security measures will impact DevOps cycles or application rollouts, but they will understand the trade-off between speed to market and security. Planning in advance how to address these trade-offs at the business level will minimize confusion and ensure a baseline of understanding across all stakeholders.Build a “roadmap to yes”: Everyone has a story “draconian” security requirements preventing them from using a technology. These anecdotes can make it feel like security is diametrically opposed to innovation. CISOs need to come prepared with a roadmap for getting to “yes” and a clear understanding of business requirements and tradeoffs.Focus on Risk and Reward to the Business: One of the most critical success factors for CISOs in a board setting is mapping the priorities of the security team to core business objectives.Lead with Resilience: Help the board to understand that there is no such thing as fool-proof security but that the risks are well understood will manage their expectations about what is possible and what risks actually exist.In addition to providing board-conversation strategies, attendees will also learn how shifting board composition is changing the dynamics on cybersecurity and technology conversations.