From communicating with the board to budget allocation — four pieces of advice for CISOs from experts

Cyberattacks such as ransomware, BEC scams, and data breaches are some of the critical issues facing businesses today. Despite many high-profile incidents, many boards are still reluctant to free up budget to invest in the necessary cybersecurity measures to avoid becoming the next victim.

Jonathan Reiber, Vice President of Cybersecurity Strategy and Policy at AttackIQ, believes that companies need to protect themselves from cyberattackers now more than ever. He offers the following insights for CISOs:

01

With the rise in global geopolitical issues, what practical advice would you give to corporate CISOs looking to strengthen their organizations against cyberattackers?

Conflicts in cyberspace are more subtle and pervasive than the day-to-day conflicts we see on the ground. Cybercriminals are unapologetic and unscrupulous in attacking, spreading misinformation, seizing intellectual property, and disregarding any cost consciousness. This is a significant challenge for modern CISOs to address.

However, CISOs may understand very well the tactics, techniques, and procedures (TTPs) that attackers will take; the MITRE ATT&CK framework outlines these twelve major TTP attacker behaviors. So the question is, why does this still happen? In a threat environment, breaches must be assumed; it's not a question of if it will happen, but when the adversary will launch an attack. Merely having this framework is not enough; security teams need to continuously test and validate these controls to deploy the best assessments and adversary simulations against security controls at scale, thereby increasing visibility.

This enables modern CISOs to continuously view performance data and helps track the effectiveness of their security strategies and processes in responding to the threat environment.

02

How can CISOs effectively explain the cost of a data breach to a company's board of directors? What type of information makes this clear to a non-technical audience?

The average cost of a breach is reported to be between US$3.86 million and US$3.92 million, and in regulated industries such as healthcare and finance/banking, that amount can be even higher and the consequences more severe.

Explaining the cost of a breach depends largely on the breach itself. For example, when consumer data is at risk, business loss is the most significant contributing factor, accounting for nearly 40% of the average total cost of a data breach. It includes many factors: customer churn, lost revenue, and the expense of acquiring new business to mitigate reputational damage.

Other factors, such as the length of time it takes for an organization to detect and contain an incident, can have a detrimental effect on the overall damage. The answer is not clear-cut, but security measures implemented prior to a breach can reduce severity as well as high costs. CISOs need to understand the current threat landscape; in the post-pandemic era, remote work has introduced more new vulnerabilities, and today's forward-looking CISOs need to take preventative cybersecurity measures to manage long-term risks.

03

An organization can invest millions of dollars in hardware, software, and people, but still get breached. What is the secret to explaining security ROI to budget owners?

To measure the success of an investment, one first needs to quantify the cost of what needs to be protected. In a simplified model, the first step is to measure the benefit of a given protection, starting with asset valuation. How valuable is this data to me? The person responsible for the budget needs to bear the risk of unprotected data. If I don't take the necessary steps to reduce risk by investing in preventative cybersecurity tools, how much will it cost if a breach occurs?

Validating an organization's controls is more cost-effective than spending money to buy more tools. By adopting a dedicated framework to counter cyber threats, for example, running threat-informed defense and utilizing automation platforms such as security validation, CISOs can continuously test and validate their systems. Similar to fire drills, security validation can pinpoint which controls failed, enabling organizations to close gaps in their defenses and be prepared before an attack occurs.

04

Since anyone can be attacked, CISOs are wondering if they should allocate more of their budget to cybersecurity insurance instead of new technology. Do you think they are making the right choice?

Over-reliance on cyber insurance without proper investment can lead to additional costs, leaving organizations more vulnerable to risks and gaps. While insurers can offset some costs, they usually cannot repair a company's reputational damage following a security incident. Similarly, if a company spends millions of dollars on research and development (R&D) and its intellectual property is stolen, no premium can recover the cost of that investment.

The best approach for CISOs is to pursue a proactive security strategy and balance it with cyber insurance, adopting cybersecurity tools such as security validation systems. An effective security strategy not only protects the organization and identifies flaws prior to cyber threats, but also helps secure cyber insurance, and deploying these systems is critical to reducing cyber insurance costs.

In response to these issues currently faced by enterprises, experts suggest that CISOs adopt forward-looking, proactive validation controls. Pyxidr is committed to simulating and restoring real cyberattack techniques, enabling enterprises to validate beforehand whether their defense systems can handle various attacks. Regarding the communication with the board and budget issues that concern CISOs, the Pyxidr security metrics validation platform can provide visualized viewing interfaces for different roles at various post levels within the organization, allowing personnel at all levels to understand the current state of enterprise security development from their own perspective of concern. By validating the defensive effectiveness of current security products and tools, it also helps CISOs clarify whether the configuration of security products is optimal, thereby enabling them to adjust budget allocations and optimize security investment returns.

| Source:

https://www.helpnetsecurity.com/2022/08/01/cyberattack-prevention-investing/