[BreachExchange] CEOs Must Champion Corporate Cybersecurity

[Audrey McNeil]

https://chiefexecutive.net/ceos-must-champion-corporate-cybersecurity/

It’s time to re-examine the way we think about and what we expect from
organizations impacted by cybersecurity breaches. A frank conversation on
the responsibilities of company leadership with regard to cybersecurity,
for both the C-Suite and the board, is long overdue. An organization’s
responsibilities around consumer privacy in many ways remain somewhat
ambiguous. Only by creating and upholding a consistent standard can
corporate America ready consumers for the risks inherent in 21st-century
levels of connectivity.

First and foremost, this means speedily and publicly acknowledging a
breach. While CEOs and their boards have a responsibility to seek out and
follow legal advice in these circumstances, this advice may ultimately be
at odds with the best interest of the public – and not being responsive to
the risks and concerns of the public will ultimately wind up hurting you
more. A protracted delay due to legal concerns or fear of bad press
increases the likelihood of a larger breach, affecting even more accounts
and individuals. It also jeopardizes a company’s reputation, which in turn
impacts stockholders, members and users – not just top-level, C-suite
executives or board members.

Once the breach is made public, leaders must do all they can to help those
affected by the breach secure their information and get their lives back to
normal. Here we can learn from Equifax: After the breach, in what seemed
publicly like a good consumer protection move, the company offered free
credit monitoring services, but using their very own product. For those
with a greater knowledge of how these things work, including the media,
this move not only seemed insufficient – credit monitoring does nothing to
restore the identities of affected individuals – it also seemed
inappropriate. Equifax was asking consumers to once again provide them with
personal information immediately following this major breach.

To be clear, there’s nothing wrong with credit monitoring if you understand
what you’re getting, but most people think it’s protection against identity
theft. It isn’t. Like the red light in your car that tells you that the
engine is overheating, credit monitoring merely alerts you to a specific
problem without fixing it.

And credit monitoring doesn’t monitor the deep and dark web, which is where
many cybersecurity threats are propagated.

Company leaders must also have a plan for how they are going to protect
employees. More companies are considering identity protection as a benefit
they can offer employees, and with good reason. Identity theft doesn’t only
impact credit cards or checking accounts: It can tamper with criminal or
medical records, endangering not only finances, but your liberty and your
life itself.

There are essentially nine different kinds of identity theft – financial,
child, social security, driver’s license, criminal, employment, insurance,
synthetic and medical identity theft – and if a someone gets hold of one of
these kinds of information, it becomes easier to exploit all the others. By
offering identity recovery services to employees and to users, companies
can make dealing with a breach far easier when it does happen and
demonstrate their dedication to worker well-being.

Lastly, in addition to providing an effective cybersecurity infrastructure,
executives must ensure that their company security practices are
up-to-date. Although there is no way to guarantee that a breach will not
happen, companies can certainly decrease the risk by taking steps like
training employees in effective password creation and usage, phishing
detection, and requiring two-factor authentication across all devices. And,
as Equifax learned, it is also essential to ensure that all customer-facing
software is patched religiously, given that lax patching procedures can
result in an open door for hackers.

Whatever you and your company ultimately decide to do, however, be sure to
act – and act soon. It is vital that the industry as a whole make its
commitment to protecting consumers clear. After the Equifax hearing,
Congress will undoubtedly feel compelled to act on this issue, and as any
CEO knows, heavy-handed polices can ultimately stymie not only a company’s
ability to respond to a cybersecurity threat, but ultimately its growth.
The extent to which congressional intervention is needed will be influenced
by how thoroughly, thoughtfully and quickly industry engages with this
issue.

And, political involvement aside, it is important for corporate leaders to
step up as a matter of principle. Identity theft can wreak incredible
havoc, decimating the finances and destroying the lives of families and
companies alike. Doing the work now to protect our employees, stakeholders
and clients shows not only that we care about the company’s wellbeing, but
that we are invested in them as individuals and want to set them up for
security and success in the coming connected century.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20171128/5196fed7/attachment.html>