CyberSecurity Enabling the Business | Part C

CyberSecurity can enable the business' success – not simply spend to outrun the criminal.

By:  Michael Meline (Cyber Self-Defense CEO) & Julie Stewart

Executives in cybersecurity often hear that unless additional money is spent, the company will be hacked or that without more funds, compliance is not possible.

“I cannot make decisions, based on immeasurable or hypothetical situations. I need to make decisions based on the real needs of the company.”   Does this sound like you or your executive?

Most companies also do not have the bandwidth to deal with the monotonous components of the security program such as countless requests for acknowledgment that a comprehensive program is in place, the late nights worrying potentially stolen data being taken hostage, or the compliance factors creating fines and other problems.

However, a proper cybersecurity program will enhance the products or solutions provided by the company.  It also will allow employees to be productive at conducting business, not being compliant.  If these things are not occurring, the cybersecurity program needs to change.

CyberSecurity | Risk Based Assessment

If a program is out of fear, rather than enabling the success of the business, there are few areas to examine:

1. Is your program a Checklist a Risk Based Approach? (See Part A: Cybersecurity Enabling the Business – Ditch the Checkbox Approach)
2. Are the mitigation requests (spending requests) prioritized according to the risks and compliance requirements associated with the individual business or industry? (see Part B: Cybersecurity can enable the business' success – not break the bank.)
3. Does the mitigation involve only tools, or does it include ALL stakeholders and inclusion processes?

CyberSecurity | Benefits of a Risk Based Program

A properly created, Risk Based program based on an effective Assessment can (and should):

• Save your sales team hours of trouble in answering the many-page vendor assessments 
• Enable a frank conversation between you and your customers about the value of your security controls;
• Ensure that your employees understand the program requirements and are active participants in the program.
• Provide clear information to stakeholders (from investors to the Board of Directors to the most junior part of the team). Instead of “We are going to get hacked", a risk-based program will communicate  “Server X has not been updated in xx days, creating a moderate risk that an external entity or malicious software may gain access/sell the confidential or proprietary data”.

CyberSecurity is simply another risk factor to be managed in business. Throwing money at the fear can be replaced by building a program addressing each risk in a properly completed assessment. This type of plan will balance rewards and penalties to the needs and objectives of the company.  If you don’t have a plan like this, the chances are that you are overspending, under-protecting, and overcomplicating your program.