![\"how](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/board-meeting-modified.jpg\")
<\/p>\n<\/p>\n
What a year 2017 turned out to be in cybersecurity: major <\/span>ransomware epidemics<\/span><\/a> such as WannaCry and NotPetya, the colossal Equifax hack, <\/span>revelations<\/span><\/a> of Uber\u2019s cover-up, records of millions of people\u2019s personal data being exposed <\/span>again<\/span><\/a> and <\/span>again<\/span><\/a>. It seemed like not a day went by without an attack, a leak, or a discovery of a major vulnerability. We\u2019ve said it felt like a barrage, with InfoSec professionals desperately moving in the trenches patching what they could.<\/span><\/p>\n \u00a0 So it is no stretch to assert that cybersecurity is not an obscure part of an enterprise\u2019s daily business; it is a fundamental, existential necessity. Leaks and hacks can destroy unprepared businesses. Survival is on the line. \u00a0<\/span><\/p>\n And yet, even in an atmosphere that blurs the lines between paranoia and justifiable fear, enterprises seem remarkably slow on the uptake. <\/span>SIEM vendor<\/span><\/a> Alienvault\u2019s recent survey discovered that only 16% of IT professionals believe their superiors have taken an interest in cybersecurity this year. Only 14% have seen their budgets increased. Only a fifth have been allowed to make necessary security changes or patches that were put on hold. <\/span><\/p>\n At the same time, the InfoSec workforce is facing a serious <\/span>staffing crisis<\/span><\/a> that is contributing to an even more severe morale crisis. Only 52% of enterprises have a CISO on payroll, and 66% of fired IT professionals were terminated for security or compliance failures. \u00a0<\/span><\/p>\n Where is this discrepancy coming from? And more importantly, how do you bridge that gap? <\/span><\/p>\n The fact of the matter is that if you wish you enact change\u2014whether that be through a new solution or an improvement in the company\u2019s digital hygiene practices\u2014you need to start at the top: the executives and board members who make the major decisions for your enterprise. But then you have to worry about the language barrier. Board members do not speak the InfoSec lingo and will be most concerned with the boardroom and the affairs therein. <\/span><\/p>\n As frustrating as it may be, you need to speak to executive in their a language they will understand. You have to get them to see past the boardroom to the threats lurking on the other side of their computers. Here\u2019s our advice on how to do that. <\/span><\/p>\n Unless they are straightforward for the layperson, most technical InfoSec jargon will fly right over the heads of executives and board members. Even if you spent the possibly extensive time to evaluate what data your company stores or find headlines about breaches of similar data at other companies, that may not move the board to action. <\/span><\/p>\n Instead, find out the exact figures on the capital that could be lost in an attack. Make sure to present not just what a ransom from a ransomware attack could be but also the lost revenues due to having to take your website down and recover the potentially lost data. Show them the possible compliance and auditing fines, the potential litigation costs and fines, and the costs of bringing in outside incident experts in the event of a particular egregious attack. <\/span><\/p>\n Don\u2019t forget to bring up the intangible costs of a hack, such as brand impact via the loss of customer perception, and lost acquisition value for your enterprises now and in the future. <\/span><\/p>\n Executives and board members are focused on profits above all. Speaking their language is the first step to getting their attention. <\/span><\/p>\n Cybersecurity is jargon-heavy, as we all know, so explaining to your board what exactly a vulnerability is or how it poses a risk can be an exercise in frustration for both parties. <\/span><\/p>\n It doesn\u2019t have to be so complex in your proposal\u2014in fact the board may be more receptive to your message if it isn\u2019t. Try explaining your company\u2019s website or database as castle, with firewalls as the actual walls, SIEM as a combination of watchtower and spy network, identity management as a drawbridge. Once established, you can convey the problem in similar fashion\u2014the walls are too thin or a certain enemy can dig under them, the drawbridge opens too readily, etc. In other words, try framing your request in a manner that can be easily imagined and easy-to-follow. Executive will be more receptive to your suggestions once they understand it as fully as possible. <\/span><\/p>\n However, this is not an invitation to make it childish; never condescend to your executives and board. Instead, use your metaphor as a comparison point to clarify your message and your enterprise\u2019s needs. <\/span><\/p>\n Even if you make it simple, be sure to emphasize how deadly serious these threats are and be prepared to answer questions in an honest and direct answer. Obscuring or hedging on your security will not do, especially if you believe the situation is dire; after all it may very well be your job on the line if you fail to properly secure the problem. State outright that the company is in danger. If you have incident reports or other documentation of previous attacks from the past month or so, share them with the board. Seeing the immediacy of the problem may help sell the board on your solution.<\/span><\/p>\n That old saying \u201ctime is money\u201d could be the motto of almost every board member and executive, regardless of enterprise. They have other concerns and other dealings that need their attention, so as important as your request or proposal is, they\u2019ll be less receptive to it if it drags on. Get to your point as quickly as possible, about 15 minutes or so if this is the first meeting, and always have a solution proposal (or a few options if the problem can be solved in multiple ways) to present to the board at your meeting. <\/span><\/p>\n Additionally, never show up to these kinds of meeting simply to highlight a problem; that will undercut your authority and will annoy board members who will feel that their time has been wasted. <\/span><\/p>\n If your solution is more in line with a company culture change\u2014such as making sure employees check their emails for discrepancies or report security issues as they arise\u2014then suggest the mechanisms by which these changes can be enacted such as through a few brief seminars or incorporating it into future training. <\/span><\/p>\n This is a crucial part of any suggestion, proposal, or request you make; if the board grants you the solution or funding you need, they will judge the success or failure of it as a personal one attached to you. You will be the face of the solution and of future problems. So it is best to explain that even if the solution is deployed, there is still a security risk that can never be truly patched. Hackers can develop ways to fool the preventative or detection methods, so constant upkeep and evaluation is crucial. Remember, getting the board to agree to a one-time solution is a Pyrrhic victory. Getting them to agree to take cybersecurity more seriously as part of the corporate culture is the real prize. <\/span><\/p>\n Sources<\/span><\/a> can<\/span><\/a> be<\/span><\/a> found<\/span><\/a> here<\/span><\/a>.<\/span><\/p>\n What a year 2017 turned out to be in cybersecurity: major ransomware epidemics such as WannaCry and NotPetya, the colossal Equifax hack, revelations of Uber\u2019s cover-up, records of millions of people\u2019s personal data being exposed again and again. It seemed like not a day went by without an attack, a leak, or a discovery of […]<\/p>\n","protected":false},"author":41,"featured_media":1186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1,3],"tags":[175,397,56,95,145,47,42,22],"acf":[],"yoast_head":"\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2020\/02\/SIEM_VM_SB.jpg\")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\nTalk Numbers…Specifically, The Numbers The Board Cares About<\/b><\/h3>\n
Make it Simple<\/b><\/h3>\n
Do Not Sugarcoat It<\/b><\/h3>\n
Always Have Your Solution(s) Ready<\/b><\/h3>\n
Never Frame Your Solution as the End-All, Be-All<\/b><\/h3>\n
Widget not in any sidebars
<\/p>\n","protected":false},"excerpt":{"rendered":"