Thomas J. Parenty - A Leader’s Guide to Cybersecurity: Why Boards Need to Lead–and How to Do It

Effective cybersecurity requires awareness of a host of nontechnical factors, or hidden dynamics. These dynamics are not lines of code or circuits etched into silicon that only engineers and programmers can comprehend. Rather, theyre business factors that you already know but might not have associated with cybersecurity.

First, we address the dynamic we call the chimera of compliancethe inherent limitations of cybersecurity standards and the regulations based on them as a way to determine a companys cybersecurity posture. Next, we look at the second dynamic, employee motivationhow employees simply trying to excel at their jobs can engage in behavior that creates new cyber risks for their company. Then we examine the economics of cyberattackthe financial incentives of the cyberattack tools and services market and raise the question, Does it really matter who attacked us? Finally we look at the asymmetry of attack and defensethe relationship between the power of an attack and the required strength of the defense, and how the cyber dynamics are completely different from what we are accustomed to in a traditional battle.

When you engage in cybersecurity, one of your first areas of interest is understanding how well your company is protected against cyberattack. Questions such as How safe are we? Are we doing the right things? Are we doing enough? are typical. In lieu of undertaking business-oriented cyber-risk assessmentswhich we will discuss later in the bookto answer these questions, companies often use compliance with cybersecurity standards to judge their level of protectiveness and to prioritize future investments. Although cybersecurity standards can provide you with useful ideas on common issues, in order to derive value from these standards, you need to understand their purpose, limits, and the unintended consequences of having to comply with multiple standards and regulations.

Cybersecurity standards, by design, address broad audiences. One metric of a standards success is the scale of its adoption. However, in attempting to speak to everyone, cybersecurity standards address the needs of no one specifically. The NIST Framework for Improving Critical Infrastructure Cybersecurity (commonly referred to as the NIST Framework) was originally developed to help reduce cyber risks to critical infrastructure. However, the introduction to the framework clearly states that any company or organization can use the standard, and companies in industries as varied as retail and hospitality are increasingly adopting it. The cybersecurity priorities for a nuclear power plant are clearly different from those of a department store or hotel. No standard, regardless of how well drafted, can provide specific guidance to such a disparate collection of organizations.

While arguably this guide provides helpful advice on cybersecurity management practices, there is nothing that specifically addresses the unique cybersecurity challenges within the industrial control systems that drive chemical manufacturing. It is sufficiently generic that it applies equally to the IT systems within the corporate front office of a chemical company and to the manufacturing systems for which it was written.

To address the lack of standards, many companies develop their own policies. This is a smart move, but you need to make sure that your own standards, unlike industry and external standards, are specific to your business. And you need to keep up with growth. If you acquire companies and build new products, your cybersecurity approaches will need to change. For example, a financial services client developed its cybersecurity standard when it relied on the computing power of scores of mainframes housed in its own data centers. This served it well for a long time. However, as market conditions evolved, its services changed, as did its method of delivery. Its standard became increasingly irrelevant.

This irrelevance became particularly important when the firm bought an Indian company whose transaction processing was hosted by a cloud provider. The first issue was that the existing cybersecurity standard couldnt give any guidance on what it should do to protect itself from the cyber risks faced. The second was that it was perennially noncompliant with the corporate standard and management had to spend significant and unproductive time dealing with the inevitable audit findings.