Are C-suite Executives our greatest risk?

[Caute_cautim]

Hi All

According to a PWC report, the C-Suite Executives are the greatest risk?  What do you think?

Do you concur or do you have another perspective? 

https://securityboulevard.com/2022/08/pwc-survey-finds-c-level-execs-view-cybersecurity-as-biggest-r...

Regards

Caute_Cautim

[mrsimon0007]

C-suite executives have wide access to sensitive data, make high-impact decisions, and are frequent targets for phishing or social engineering. That makes them a significant insider risk if they are careless, misinformed, or compromised.

[vishybear]

i remember as a desktop support guy... it was ALWAYS directors who'd leave laptops on the train


Sent from my iPhone

[denbesten]

This is why one implements automated group policy mechanisms to encrypt hard drives, enforce screen locks, use MFA when possible, and to enable remote-wipe-and-report.

Also, buy them an Airtag to keep in their laptop bag.  Might cause their phone to beep while there is still time to go back for it.

[ervinfrenzel]

Absolutely, that is combined with our technicians/technology specialists.  If I may explain.  According to the governing bodies (IEEE/ACM, INCOSE, ISO, etc), cyber is the combination of the people, processes, and technology.  Combined this becomes a socio-technical system (or STS).  Much of leadership came from a single technology or field - this skews the leader into believing their "flavor" is the single cybersecurity "flavor" - this month it is "AI", it has been "secure software", "IT based security", "IS based security" etc.  I have been told multiple times I cannot fill a "C" suite role as I can explain threats so other org leaders can understand what is going on.  This terrifies me.

When leadership neither reads nor understands the whole picture, they handicap their own organization (people), their processes, and hinder their technology.  Worse their actions can impose the actions onto business affiliates tied to them (think third party risk) their actions not only expose themselves and their organizations, but anyone doing business with them.

Currently, I am working on job crafting research, oddly multiple vendors (two of the big ones) are still saying Cyber is a sub component of Information Technology, Computer Science, Computer Engineering, Software Engineering, Data Science, or even Information Systems.  Information Systems is probably the closest to being correct (as it should have an integrated STS).  If your certification body is antiquated and out of touch with reality, how can you be anything but?

I realize this isn't just about cybersecurity but all "C" suite folks, if their decision making processes are antiquated because those teaching them are antiquated (think tenure faculty who have not updated their "general knowledge" but only conducted specialized "research" they want to deal with).  This is job crafting, it is how we broke up our departments to begin with - do what you are good at, let others deal with what you are not good at.  Those who are good at our weaknesses, often hate what we are good at.

As a side note, several certification bodies went on to say they are only responsible for "digital"components, not responsible for end-users, end-user actions, or the processes of the organization.  Essentially, when we look at breaches, we recognize breaches occur in the people, processes, or technology - essentially finding the weakest of the STS countermeasure components.  Certifying bodies who deny the people or processes are saying it is someone else's job - but definitely not theirs. I cannot respect any cybersecurity certifying body that says "it's someone else's problem".

We as professionals are responsible for our working organizations, we can vote our profession (by membership), by researching, and by refusing to be part of organizations that refuse to update their philosophies or be responsible for their professionals.

[vishybear]

There is a MASSIVE issue in the tech industry across the whole board that refuse to acknowledge that humans exist.

Everyone has processes, ‘good practices’, standards, etc etc yet are STLL surprised when a user will do something because it makes their job easier to do. Or Directors that insist on letting their kids use Minecraft on their work laptops. I’ve even worked in a place where we provided IT support to a directors wife and kids.

Every department in organisations is understaffed now, outsourcing, offshoring make things even harder. Yet for some reason, saying to the Directors or the C-Suite..”YOU decided to stick this Helpdesk offshore and YOU decided to make our IT support work out of the same office builds and sound identical to the scammers that call our users everyday. How come it’s suddenly OUR problem” is seen as something that isn’t done. (Unless it’s me)

I think training needs to be directed toward the technical resource on how to understand humans as much as it’s needed for staff to understand how to recognise a phishing email.

There’s been too much STEM STEM STEM recently and not enough concentration on looking at the soft skills, psychology, basic human nature and how to talk to people.

[nkeaton]

@vishybear   We have been emphasizing STEAM for years because of that soft skills component.  You are correct that they need those very human interaction skills.  

[jbuitron]

It grates on my nerves, like fingernails on a chalkboard . . every time I see the phrase "IT Security." The 'information technololgy' portion of 'security' is only a percentage of the entirety.

And, you mentioned how cyber professionals like CISOs are continually placed 'under' authorities like the CFO, the COO, the CEO, ad infinitum, ad nauseum . .   I found a paper by Rebecca Herold that clearly states (and logically so) how the CISO should/must be independent and not have their authority hamstrung or shackled. (Now, I need to scan that work into my PC) . . or find a copy online.

keep thinking . . it may be a dangerous occupation, yet it is Now needed in cyber More than Ever,

Dr. Jan, DCS

(aspiring CISO)

[dcontesti]

@jbuitron agree with you.

Most do not see the entire picture and many think it is an IT issue.  WRONG for so many reasons.

I have always found it amazing that Audit gets a seat with the Board but not Security.  I suppose that comes from external Auditors pounding on tables and pointing to deficiencies.

If you find Rebecca's paper, would love to read it.

Regards

d

[jbuitron]

Hi dcontesti,

Rebecca Herold's work on Organization and Roles is within this edition of the Information Security Handbook available online at: 

https://www.ic.unicamp.br/~rdahab/cursos/inf712/repositorio/ISMHandbook_toc.pdf

I have a copy of the .pdf attached. Please keep in mind that cybersecurity/Information Security papers regarding structure and operations that do not 'get old' like Microsoft Windows '95 does. Great Work is always Great work! 

This ISC2 site won't allow me to upload the .pdf with just the article in it. Nevertheless, it is in the handbook at the link.

This was the first paper that I found when I was starting the Norwich U., MSIA in 2008. It STILL RINGS TRUE.

best regards,

Dr. Jan F-B., DCS

CISSP, C-CISO

[ervinfrenzel]

Ok, So let's recognize we are talking about two separate types of security - IT Security is just that security that deals with IT I'm including a pic to assist.  The reason it is important to recognize is that ISACA and such state Cyber is a sub-component of IT Security which is a sub-component of IT which is an enabler for the business.  Effectively we are fighting the colleges of business on this one (which I am totally good for).  I realize we are not ISACA, but many of the leaders in business have subscribed to those philosophies and ones like them.  When I wrote my exegesis - I spelled these out.  Since then I have simply created a chart to help folks (mostly students) understand - there is a place within business for IT security, and IS security, and secure software development - but this fight has been going on for some time.  We have to recognize that IT absorbed IS, or most of its functions in the early 2000's - and the terminology IT now means something different to business than it does to technologists.  In business it means all of the technologies used to regulate their organizational technology - effectively everything.  In technology it is the hardware and software used by technologist to keep the organization going..  It's a subtle difference, but one just the same.

Remember if we want to properly address the problem, we need to address it properly.  We need to recognize that all of us are not cyber practitioners.  Some are technology specialist (which are as important if not more so at times), some are people specialists, some are process specialists.  Bottom line is cyber is not an individual sport, it is a team event - it takes everyone together to make it happen.  From the listing above, all of the components are necessary to create a defense.

At least if they are referring to it as "IT Security" and they understand it from the technologist point of view, we have hope to educate them about other securities and make an organizational change.

Ervin Frenzel, PhD

Cybersecurity Leadership

CEI, CCISO, CISSP-ISSAP, CISSP-ISSMP, ECSA