Alain Sanchez, EMEA CISO at Fortinet, explains why cyber-risk is synonymous with business risk. He emphasises that now, more than ever, it is crucial to engage the board in understanding and addressing cybersecurity risks. For CISOs, securing the board’s support is more important than ever before.
Cyber-risk is business risk. Anything that threatens IT threatens the company. We have become extremely dependent upon our digital assets. As a result, business leaders need to realise the magnitude of the change. The essence of what visionaries have shared with me in the last couple of months shows how much cybersecurity is now a permanent topic of discussion among CISOs and their corporate leadership.
Assessing cyber-risks
Perhaps the most crucial role of the CISO is to rank cyber-risks by order of actual impact. This requires an equal understanding of business and technology, as well as a sense of how objects that were never designed to be secure behave under attack. It is not an easy task, and not only for technological reasons.
Part of this assessment requires understanding the priorities inside the organisation’s value chain and securing them accordingly. The second challenge is to look beyond the organisation and see how outside forces may impact it. And among these external forces, we find the compliance framework.
These new laws and regulations are necessary. They protect human beings, intellectual property, and the ability to invent and innovate. From this perspective, compliance standards are good. However, their demands are increasing daily.
This very duality, good and complex, challenges many IT departments. They must ask themselves: How do we integrate legal considerations into what used to be a pure technological battlefield? The solution is to start from the top.
The board of directors should always have this duality in mind. The more directors know about cyber-risks and government regulations, the better. Consider the European Union’s Digital Operations Resilience Act (DORA). This legislation is focused on the European banking and financial system. Still, its mindset and practices can be applied outside the financial domain, particularly as risk is a central component of these practices. More than ever, getting your board on board with cybersecurity risk is key today.
Mitigate risks
In the past, resilience was more of a technical concept. It was about bringing back the servers. Today, it is a legal requirement documented by an auditable plan. We have moved from a series of technical steps to a contractual re-establishment of critical services.
Four types of considerations underpin these plans:
- Prioritised recovery: A very delicate ranking that can only be established through a regular exchange between the board and the operations team. The board’s sign-off is crucial here. Otherwise, who would ever qualify their own activity as non-critical? However difficult to establish, this ranking is truly a fascinating exercise that brings the CISO and team to the heart of the business.
- Defending strategies: Assessing the right combination of products, services, staffing and processes is crucial. Less is more in this matter. After years of accumulation, cyber-officers have realised the hard way that a maelstrom of products and vendors was not very efficient. The next era of security will happen via convergence, not addition.
- Offer options: This is about providing information and an array of solutions in which, ultimately, the board makes the call. It is part of the CISO’s job to offer scenarios as a series of documented steps: investment 1, timeline 1, benefits 1 and risk 1. Then, the CISO can suggest a second and a third sequence of the above. Choosing how to proceed is the board’s job. This way, the CISO becomes an empowered execution lever for a consensual decision instead of being pinpointed as the only one to blame for the results.
- Executive leadership: The CISO needs to report directly to the CEO, otherwise the job is a ‘widow maker’. The consequences of unclear or diluted support go beyond the discomfort of the position; the survival of the company is at stake. In 2024 and beyond, submitting cybersecurity to any other consideration than the company strategy is a major governance mistake. Like the Titanic shipbuilders who traded rescue boats for rooms on the sundeck.
Cybersecurity is not only about avoiding icebergs. It is a holistic approach that embraces all the active and passive security dimensions into one integrated platform. Holistic here does not mean monopolistic. Legacy, old-school, best-of-breed and point solutions are facts of life. However, the number of technologies, vendors, processes and the magnitude of digital transformations call for simplification.
Too often, this maelstrom turns into major incidents that operate as wake-up calls. Then the question is not about the one million dollars we did not spend, but about the 100 million dollars we just lost.
