As cybersecurity issues become more prevalent, one position within the corporate ladder is gaining new attention: the chief information security officer. The financial burden of data breaches continues to rise. One recent report from Accenture stated that the average global cost of cybercime reached $11.7 million in 2017. This was a 27.4 percent raise from $9.5 million in 2016.
Along with the rising expenses of cyberattacks, companies have been spending more on protection, primarily on CISOs. Security Current data indicated that the overall average salary for an CISO was $273,033 by end of 2016 and this number is only expected to have increased. As organizations continue to pay more for CISO expertise, the question becomes: What value do CISOs truly bring to the organizations they serve?
Distilling decision-making to one person
Cybercriminals have certain inherent advantages over the companies they target. For one, their anonymity. Hackers typically research an organization's staff as this aids with spear phishing and other data breach initiatives. By contrast, businesses have no certainty they're even being targeted until they've been attacked.
Another crucial advantage on the side of hackers is that many corporations, especially those small- to medium-sized businesses, don't have CISOs. This means that all cybersecurity policies and initiatives must go through the IT department or other group. When a chief technology officer has to deal with cybersecurity on top of other duties, the initiatives can be slowed, in some cases encountering month-long delays or more.
Cybercriminals are constantly adapting and incorporating new malicious software into their arsenals. In order to keep pace with this rapid innovation, one person within the organization must function as the hacker's opposite, keeping the company cybersecurity policies fluid and responsive. As Helpnet Security pointed, CISOs must not only be leaders but also serve as the link between innovation and defense. A single, dedicated person can do this much more effectively than a distracted team.
Presenting a single, unified cybersecurity vision
Likewise, a C-level executive is typically the only class of employee capable of making real, impactful decisions within a corporate structure. Unfortunately, many executives and decision-makers remain uneducated about issues of cybersecurity. A BAE Systems survey found only 42 percent of executives felt they were very or extremely knowledgeable about their company's cybersecurity policies.
In order to create comprehensive, overarching information security standards, businesses need a respected voice in the room who can articulate and educate other executives on the need for cybersecurity initiatives. CISOs have this presence and, unlike CTOs, they are not hindered by distractions that can occur in other business segments.
"Think in terms of 'when' instead of 'if.'"
Creating and updating corporate response strategy
Experts agree that companies that develop cyberattack response strategies minimize losses and more quickly seal breach points. While it is nice to hope that your organization will never be affected, the far more prudent strategy is to think in terms of "when" instead of "if." When a cyberattack occurs, organizations must have a clear, itemized response plan.
According to Risk Management, the best plans are proactive; changing biannually or even quarterly to adapt to new methods of cyberattack. A comprehensive plan includes steps like workforce education, breach detection tools, consumer alerts and legal recourse tools.
Once a data incursion occurs, the CISO and his or her team must be able to detect it immediately. With cyberattacks, the longer they go unnoticed, the worse they are. Placing a CISO in charge of maintaining and updating this response plan will ensure that it gets done and comes from a point of clear authority.
When a data breach occurs, the last thing that decision-makers want or need is to be arguing about what to do and who should do it.
Allowing the IT team to focus
IT teams within companies are frequently overburdened. In addition to maintaining and updating company software, IT personnel regularly respond to the daily crises of other employees. Every hardware, email or other type of problem distracts IT groups from performing their primary duties.
While typical employees tend not to notice whether or not an operating system is updated, it is these performance checks that ultimately help keep company networks safe from unauthorized access.
Bringing in a CISO allows the IT group more time to focus on their core responsibilities. The CISO may even operate alongside regular IT staff during certain times, however, it is best not to overlap duties too much. CISOs can handle red flags, such as phishing emails and imbedded malware that may otherwise escape detection or occupy IT manpower.
CISOs don't need to be paid a quarter million dollars a year to be valuable. Essentially, they act as a point person in the realm of cybersecurity, a clear head that can dictate commands and formulate strategy. Too often, companies take a relaxed approach to cybersecurity, which almost always results in lost income and damaged reputation.
For organizations that cannot afford to keep a full-time CISO, other options remain. Cloud solutions tend to be more secure than in-office networks and some managed IT providers offer the same level of oversight and proactive planning. Regardless of who or what is in charge of information security, companies must prioritize all compliance and protection development as crucial issues.