Schedule a Demo

Whose Job Is It to Manage Cybersecurity? Hint: Stop Pointing at the CIO

Picture of Pareto Cyber

Pareto Cyber

Cyber threats are real

Schedule a Demo

Subscribe newsletter

Too many enterprises treat cybersecurity as an afterthought, delegated entirely to the CIO and the IT department.

Yet organizations across the board are dealing with more frequent and variable cyber threats on an unprecedented scale. According to McKinsey, attackers are not only collaborating but also leveraging emergent technologies, such as artificial intelligence, to conduct attacks. These novel approaches are extremely risky for any companies these groups may target since the full attack cycles will speed up by a wide margin.

Despite several recent high-profile cyberattacks, most organizations are refusing to take security risks seriously. In a recent PwC’s 2022 survey, 63% of corporate executives claimed that their cybersecurity efforts do not get sufficient involvement and support from their CEOs.

Protecting your organization involves a lot more than hiring some IT specialists and buying security software. If you want to avoid costly data breaches and associated business consequences, your entire leadership team needs to work on managing security operations.

Here’s an overview of why organizations struggle to share responsibility around cybersecurity, and how to create a more productive security culture in your organization.

The Problem with Enterprise Cybersecurity Management

Leaving cybersecurity to an isolated CIO and IT team without agreement from other stakeholders and company leaders is dangerous. Given the prevalence of cyber attacks against businesses across industries, investing in a robust threat management program is a must for protecting your business interests.

There are two main reasons enterprises lag on prioritizing cybersecurity:

  1. Reactive Threat Management
  2. Siloed Security Operations

Reactive Threat Management

The high costs of a cyberattack are clear from even a brief glance at industry publications or recent headlines detailing breaches against high-profile organizations.

So why are managers not acting in proportion to those risks?

A lot of the gap between the perceived importance of cybersecurity within security professionals and other executives is caused by basic cognitive bias. While even a single data breach can significantly harm business operations, most companies underestimate the likelihood of getting attacked (before an attack actually happens).

Improving security operations can be quite time-consuming and expensive, and a hypothetical risk doesn’t seem urgent enough to prioritize. So managers are usually reactive rather than proactive, acting on cyber threats only once an attack has occurred.

This reactive approach puts your organization at a real risk. Cybersecurity cannot be treated as an occasional investment, because cyber threats and remediation strategies involve a lot of unpredictability and change.

Siloed Security Operations

While delegating security operations to IT specialists and relevant executives (CIO, CISO, etc.) may seem natural, a siloed cybersecurity approach is not effective against modern threats.

When your security staff is not communicating with the rest of the executive team, the perception of how good your enterprise cyber maturity is may not reflect reality. According to a 2020 Netwrix report, 66% of CIOs don’t report security related metrics and performance to their executives.

A communication gap between business and technology stakeholders can lead to a lack of investment in IT and security operations. In fact, 58% of companies surveyed by a recent IIF and McKinsey survey acknowledged they do not spend enough on cybersecurity.

Bridging the Gap: Business Impacts of Cybersecurity

Many problems with cybersecurity management start because some of your executives may not understand how cybersecurity affects your organization’s overall performance.

To overcome this communication gap, you need to frame the discussion in terms of business objectives and metrics familiar to your company’s leadership. Translate the metrics your security team uses (such as the mean time to detect a threat, number of security alerts faced by your business, etc.) into financial risks that your organization could face.

Create a sense of urgency by helping your executive team picture the specific consequences that they might have to deal with in the event of a breach. It may be helpful to mention the specific vulnerabilities for your industry and business type, as well as the exact types of attacks that are commonly seen within your space.

Steps to Improve Cybersecurity Management

Developing a culture of accountability around cybersecurity in your organization should begin with involving all relevant stakeholders in those efforts.

To help prioritize risks of cyber threats, discuss not only the threats themselves but also their likelihood, business impacts, and what company assets are likely to be compromised.

You should work with other executives to relate business activities to any corresponding security risks and vulnerabilities. This collaboration should become an ongoing effort, as your organization’s risk profile can change with any acquisitions, operations, or shifts in market conditions.

There are many ways to involve your business executives in improving your cybersecurity. For example, you can try running simulated cyberattack workshops to help executives practice responding to an active threat and then reflect on their strategy and approach. Deloitte recommends that you should build your approach on bridging the security impacts with business outcomes and financial terms.

No one person can manage cybersecurity on their own and companies need to take a more proactive and collaborative approach to security operations. By highlighting the risks of avoiding ownership over cybersecurity, you can motivate more people in your company to get involved and help protect your organization. 

Share

Related Articles

Cyber
Hygiene
Engineer
  • Responsible for data analysis and interpretation of required hygiene data sources; Vulnerability, Identity, Patching, Device Management, Cloud, and Networking. The role of the Cyber Hygiene Engineer is to provide prioritization of risks identified in the environment. Their overall goal is to rapidly reduce client risk related to Cyber Hygiene gaps.
Threat Hunters
& Red /
Purple Team
  • A cross-functional operations and engineering team responsible for developing threat use cases based on the technologies deployed and operations within a client. Our Threat Hunters are using the latest intel technologies to understand threat actor groups and motives targeting clients and provide use cases for SIEM implementation. Then our Red/Purple team provides our hunters and platform engineers with the latest tactics being used to help clients stay ahead of the latest threats.
Strategic
Cyber
Risk Advisor
  • Our Cyber Risk Advisors are focused on analyzing data integrated and correlated within the Cylemetry platform. This analysis allows our CRAs to provide clients with strategic and tactical recommendations on reducing overall cyber risks.
Customer
Success
  • Responsible for ensure all Pareto teams are meeting client expectations, service level agreements, and taking overall feedback for service improvement.
Platform
Engineer
  • Responsible for installation, configuration, and continuous improvement of client and Pareto support technologies used during service operations. Additionally, Platform Engineers provide content development, log source tuning, and security solution tuning support.
IR
Engineer
  • Responsible for using digital technologies available to assess total risk exposure of an incident / breach, provide in-depth Eradication, Remediation, Recovery, and Root Cause Analysis (RCA) services for clients that experience a successful attack.
Threat
Intel
Analyst
  • Collect, Process, Analyze and Report on enterprise and open-source threat intelligence to track threat actors, malware strains, or phishing campaigns that may affect our clients and their industry.
Threat
Detection
Analyst
  • Responsible for management of security alerts within security technologies, internal escalation of alerts to events or incidents, development of threat reports, threat surface analysis, and support of IR Engineering, Threat Intel, and Platform Engineering.
Threat
Detection
Lead
  • Accountable for daily operations, such as Threat Escalation Management, Remediation Approval, Service Level Agreements, Customer Communications, and Root Cause Analysis.
Penetration
Tester
  • Works alongside the Threat Hunter and Threat Intelligence Analyst to build and test SIEM alert rule content, based on the newest adversary tactics.
Threat
Hunter
  • Performs prescribed threat searches within the client’s environment, reporting any findings. This skill is also considered the SME of internal client IT operations and can determine legitimate client network traffic.