Are We Secure Yet? How to Build a "Post-Breach" Culture

Are We Secure Yet? How to Build a
There are many ways to improve your organization's cybersecurity practices, but the most important principle is to start from the top.

Are we secure yet? I was asked this question in a board meeting a many years ago. The way it was phrased implied that getting secure is a task to be completed. Managing cybersecurity is actually more like doing the laundry, in that it's never finished. So, are we secure yet? The answer is an emphatic "No!" And we collectively never will be secure. However, we can and must apply rigorous risk management processes, innovative control technologies, and talented teams to our cybersecurity challenges. 


The subject of this discussion is your organization's cybersecurity culture. It is one of the most critical elements of a successful cybersecurity program and yet one of the most difficult to define, measure, and improve. Over the past decade, we have witnessed a constant cadence of major cyberattacks. The majority of these were cases in which the victims were required to disclose the event by statute or regulation. Others were disclosed as a result of highly visible business disruptions caused by the attack. Many of these were data breaches involving over 100 million records (for example, Target, eBay, Equifax, Capital One, Marriott, etc.) while others were ransomware attacks resulting in major disruption to their victim's businesses (such as Maersk and the city government of Atlanta).


These attacks were costly and traumatic for the victim organizations but also had at least one positive result: They transformed the organization's cybersecurity culture. The change in attitudes about cybersecurity in these cases can be dramatic. One CIO shared that a security investment decision that once would have taken weeks or even months to make now, after the company's recent breach, required only a short c ..

Support the originator by clicking the read the rest link below.