Category Archives: Uncategorized
CISOs: Embrace a common business language to report on cybersecurityThe U.S. Securities and Exchange Commission (SEC) recently issued updated proposed rules regarding cybersecurity risk management, program management, strategy, governance and incident disclosure for public companies subject to the reporting requirements of the Securities Exchange Act of 1934. As a result, the SEC may be amending previous guidance on disclosure obligations relating to cybersecurity risks and cyber incidents to include processes that require organizations to inform investors about a company’s risk management, strategy and governance in a timely manner with any material cybersecurity incidents.Over the past two years, security breaches have been on the incline as digital transformation has rapidly increased, expanded and affected business models, customer experiences, products and operations. Now a top business risk category for many companies, cybersecurity is increasingly a focus and conversation at the board and C-suite level.And, since the role of the chief information security officer (CISO) has grown dramatically from not only protecting the technology, but all of the supporting data, intellectual property and business processes, companies are recognizing the need for the CISO to have increased access to the C-level and board to help with business decisions.The challenge, however, is that often security leaders traditionally communicate in technical and operational terms that are challenging for business leaders to understand. For CISOs to be effective, they must adopt a holistic security program management (SPM) strategy. This approach will support the ability to communicate and report on cybersecurity efforts consistently in business terms, using outcome-based language, and connect security program management to their business’ key priorities and objectives.What is cybersecurity security program management (SPM)?SPM reflects modern cybersecurity practices and supporting domains. This approach supports a common language that can be applied across industries and understood by both technical and nontechnical executives — while adapting and shifting in business outcomes, technology and the threat landscape. However, for SPM to be successful, the security industry needs to refocus from centering on compliance frameworks to SPM methodologies that are continuously updated and managed throughout the year. This approach will broaden business insight into key elements and technologies of a modern cybersecurity program such as application security, cloud security, account takeover and fraud.SPM has been proven effective in guiding security leaders to continuously measure, optimize and communicate their program needs and results. In fact, consistency of SPM has proven to provide continuity in security programs — even as people may change roles — and for reporting, ensuring that metrics are accurate and reliable.Despite the elevation of cybersecurity as a top board priority and concern, businesses need to address the “elephant in the room” — the failure of communication and common understanding between the CISOs, security programs, and their boards’ understanding of SPM. Organizations are recognizing that only a small percentage of their security teams are being effective when communicating security program strategies and risks to the board, according to a Ponemon study.CISO: Cybersecurity support starts at the topThis can be described in two parts. First, the board needs to understand the biggest risks to revenue — cyberattacks are not cheap. Cyberattacks can be an expensive threat to companies. Yet, few companies can communicate their security program effectiveness to executives and the board in business terms that can be quickly understood.Second, communication has to be consistent across the organization. We must embrace business language and terms from one business unit to another. For example, in comparing two business units, one may generate revenue but the other may not because the second business unit may be a support role for the company. The security program may prove to be optimal in the first business unit yet not in the second. Why not? In speaking with the executives and board, the security leader must speak at a level that their stakeholders understand in order to be aware of what a comprehensive security program will reveal. Providing relevant, digestible information on SPM and its progress both up and down the ladder — to peers, team(s), the C-suite and board — is critical.There is no one quick fix to address and remediate all security issues. Over the years, organizations have implemented various strategies to remain compliant. Though compliance is not as comprehensive as a security program: it may only focus on certain pieces of people, processes, technology and assets that are in scope for a particular compliance effort. Others have implemented SPM to increase transparency and help C-level and the board better understand and assess the maturity and comprehensiveness of a company’s cybersecurity program, and therefore the relative levels of risk exposure that companies face.The bottom line is that CISOs are hired to protect the company’s data, applications, infrastructure and intellectual property (IP). As companies move forward in the 2000s, the focus is on data being the new currency — we must embrace SPM in order to be successful in reporting on our cybersecurity efforts.Making a difference for the businessGartner predicts that by 2025, 40% of boards will have a dedicated cybersecurity committee overseen by a qualified board member. At the board, management and security team levels, this is one of the several organizational changes that Gartner forecasts will expand due to the greater exposure of risk resulting from the digital transformation during the pandemic. To effectively lead, the security leader must have decades of security program experience, have previously reported directly to a board, become an advisor or an independent board observer and have reputable security certifications. With those qualifications covered, the CISO will have the business acumen and support to get the job done. As a key advisor to the board, a security leader will help increase the awareness of the financial, regulator, and reputational consequences of cyberattacks, breaches and data loss and be central to risk and security planning. These discussions will ensure risks are reviewed, funded or accepted as part of the organization’s business strategy.Demetrios “Laz” Lazarikos is a 3x CISO, the president and cofounder of Blue Lava.
ARTIFICIAL CYBER NET WAS LIVE 4.7K VIEWS
osun tech summit highlights!
infinite tanks to God,
event was successful.
Artificial Brain taking AI dev class
it’s is today! a must attend 3 day’s program for developers.
cant wait to see you!
Oakland, Mich., Schools Consult Industry for Cybersecurity EdThe district’s CTE campuses have been working with technology leaders from the county and private sector in recent years to ensure cybersecurity course curricula are aligned with ever-changing workforce needs.July 20, 2022 by Brandon PaykamianWith cyber criminals fighting constantly to stay one step ahead of IT security professionals, staying up-to-date on changes in the field of cybersecurity is vital for school districts and workforce training programs preparing students for jobs in the industry. Seeing the need for industry insights, Oakland Schools in Michigan has been working with county technology leaders, private companies and other industry partners to align its cybersecurity curricula with the needs of employers.According to Jarrad Grandy, executive director of student services at Oakland Schools, the district’s technical educators meet with employers at least twice a year as part of a cybersecurity education advisory committee for Oakland Schools Technical Campuses, the district’s career technical education schools, to evaluate their cybersecurity courses.“In the 2018-2019 school year, we switched to a model that was much more employer-driven. Their role is to consistently and constantly give us what they’re seeing in the field,” Grandy said, noting that the advisory committee is just one of several that guides technical programming at Oakland Schools.“They help us figure out what we need to teach kids,” he added. “They give us advice on what’s coming, what we should focus on, or what we should focus on less, and we must combine that with state standards.”Grandy said much of the cybersecurity course content, tech equipment purchases and assessments are regularly evaluated and adjusted as needed with the help of said industry partners, who collaborate with educators and administrators to align courses with workforce trends. He added that employers also work with the district to guide activities such as cybersecurity simulations, wherein students get hands-on experience dealing with cyber attacks and data breaches.“This is an employer-driven process … We’re driven by what the industry needs,” he said. “If we’re doing what we’re supposed to do and you like the output in the long run, then the goal is to get every kid who is interested and meets the employer standards to be gainfully employed.“You need to have employers who say, ‘This is something to actually pursue and invest in,’” he continued. “For us, in the last five years or so, we’ve really focused as an organization on making sure that what we do is employer-driven from the programs we offer, to the processes we use, to the systems we design and develop.”According to a 2020 analysis by the Bureau of Labor Statistics, demand for IT security professionals is expected to grow 33 percent by 2030 amid an increase in cyber attacks against public- and private-sector organizations with growing network vulnerabilities, due in part to the rise of telework during COVID-19.While employers’ specific IT needs can vary from company to company and industry to industry, Grandy said, most are in need of workers with at least some degree of IT security knowledge as workplaces become increasingly digitized.“Depending on the partner you talk to, many times what we end up hearing is you need kids with soft skills. That’s one part of it,” he said. “The basics are the basics — how you handle data protocols, how you handle data from one server to the next … Our kids work on the fundamentals of cybersecurity, but while they’re working on the fundamentals, they’re getting work-based learning opportunities where they get to see in real time where there may be a data breach, or an employer says, ‘Here was a data breach we had in the past, and here’s how we approached it.’”Noting that IT skill sets have become increasingly integral to operations across industries today, Grandy said one of the committee’s main focuses recently has been to integrate the district’s cybersecurity programming at its Southwest and Southeast campuses with other technical courses.“I see cybersecurity becoming more and more attached to all of our programs. IT, in many ways — and cybersecurity as a subgroup — is an enabler industry,” he said of the district’s tech ed plans moving forward. “There’s cybersecurity in construction, cybersecurity in health, cybersecurity in auto. For our system, what we’ll be doing over the next few years is much more collaboration in our programs we offer to give students a realistic view of how their work is going to impact other industries … In general, we will see more integration of our programs across industries.”
AI movement
we go again tomorrow… join the technology of tomorrow 💪
Artificial cybernet updates. info 