This week:

3 – Why CFOs and CISOs need to collaborate

2 – Why CFOs need to listen to CISOs

1 – Why IT Leaders need to listen to execs

 

3 – Why CFOs and CISOs need to collaborate

“Cyber risk is just another form of business risk and probably one of the most hazardous.”

Summary: According to this recent article, “Fines from regulators and ransomware events can result in an organisation’s downfall”, so it is critical for CFOs and CISOs (Chief Information Security Officers) to work together, even though “one is driven by cost management and profitability, the other by digital security and infrastructure.”

So what? What does a CFO and a CISO have in common? They spend their days managing risks. If the CFO focuses on managing the risks to an organisation’s profitability, fines from a regulator or the costs of a cyber attack should be two of the more significant risks on their radar.

Source: Raconteur

 

2 – Why CISOs need to listen to CISOs

“Companies with advanced cybersecurity ratings create nearly 4X shareholder value”

Summary: A Diligent research report, mentioned in the earlier Raconteur article, suggests that investment in cybersecurity defences not only reduces the risks and costs of a cyber attack, but may even increase the perceived value of the firm. The finding is based on analysis of large firms in many Western markets and cross-checked with security information provided by Bitsight.

So what? Which came first: Better cyber investment decisions leading to higher shareholder value, or higher shareholder value providing the resources to make better cyber investment decisions? Or just like the number of storks and the number of newborns in a country, is this a correlation without a causation?

Source: Diligent Institute

 

1 – Why IT Leaders need to listen to execs

“Top business leaders’ confidence in the effectiveness of basic IT services is only about half of what it was 10 years ago”

Summary: According to a study of 2,500 business and technology executives by IBM, “C-suite executives’ confidence in their IT team’s ability to deliver basic services is declining”. Why the decline? Well, for one thing, “business leaders themselves are somewhat more technology savvy” and “expect everything to occur at internet speed”. What they don’t see is the major work that internet-based service providers have to do behind the scenes to provide that level of speed and reliability!

So what? I’ve said before that security is not just about technology, but the IT team usually plays a key role in identifying the most appropriate ways to deal with security risks. If executives don’t even believe IT can deliver basic services, is it really so surprising that they are reluctant to approve big spends to improve security defences?

Source: ZDNet  (via Secure The Village)