How do you get stakeholders to care about cybersecurity?

1. List Key Personnel: Start with your organization's leadership, IT, and security teams. 2. Understand Impact: Identify departments or individuals affected by potential cyber threats. 3. Consult Experts: Engage with external cybersecurity consultants or vendors. Consider Legal & Compliance: Include those responsible for legal and regulatory compliance. 4. Engage End-Users: Remember employees or users who'll interact with the security measures. By recognizing these groups, you ensure the right people are involved, making your project more successful.

Getting stakeholders to care about cybersecurity is all about speaking their language: Show them how a single breach can tank revenues, harm reputation, and even risk the company's very existence—then they'll listen.

The interest and influence of stakeholders will help distinguish between key stakeholders and informed stakeholders. Key stakeholders for cybersecurity usually have high influence and high interest in the program. They are actively engaged and require the most frequent communication. Good examples of key stakeholders include the board who has a responsibility for governance and oversight of cybersecurity, shareholders and regulators who have an interest in the effectiveness of cybersecurity practices, and customers who may be impacted by poor cybersecurity. I would focus on building trust key stakeholders through continuous engagement, providing relevant information to keep them informed, and even soliciting their input.

Getting stakeholders to genuinely care about cybersecurity requires a radical shift in perspective. While discussions and education are essential, true investment parallels the real experience of getting caught in the rain without an umbrella despite a weather forecast. So make it rain on the stake holders and we'll see them care more than the business itself.

You need to discuss (not explain) value within a common frame of reference. That may be money, risk appetite, physical or emotional safety, market share, or labor depending on your audience. If you don't take the time to establish the definition of value first, the rest of the conversation will involve two or more people talking past each other.

To explain the value of Cyber Security to Stakeholders, Leaders and employees. You must learn to speak in their terms. Stakeholders don't want to hear about CVEs or End of life servers, they want to know how it may affect productivity, compliance, the companies image and how it may affect the company's future. Leaders want to know and understand what policies and controls need to be inplace to ensure that their teams can work with minimal risk and interruption. The day to day employees need to be aware policies and how to work within their systems and tools securely and productively. We often say that Security & Convenience do not go hand in hand. Convenience is a matter of perspective, its our job to teach good security habits.

You must tie cybersecurity objects to business objectives. There is no other way to drive an impactful cybersecurity initiative without drawing a straight line to the organization's core operations. In a for-profit company, that might be showing where enhanced cybersecurity will result in greater resilience (read, resistance to failure) for business operations. In a government agency, that might translate to showing how cybersecurity planning in advance will save labor associated with re-working a process retroactively when it needs to meet regulations as a prerequisite to gaining approval from higher echelons. Cybersecurity is often viewed as a "nice to have". As a cybersecurity expert, it's your job to make it "essential to function".

Cybersecurity is akin to a safety net for businesses. Data is a valuable asset. Protecting it ensures: Business Continuity: As insurance safeguards against unforeseen events, cybersecurity prevents cyberattack disruptions. Reputation Management: A breach can tarnish a brand's image, leading to lost trust and customers. Financial Health: Cyber incidents can result in fines, lawsuits, and lost revenue. Competitive Advantage: A robust security posture can be a differentiator, attracting clients who value data protection. Regulatory Compliance: Many industries face regulations requiring data protection. Being compliant avoids penalties. Cybersecurity is an investment in the company's resilience, reputation, and future growth.

The value of security should describe the business impact realized from the existence or lack of controls and practices. Factor Analysis of Information Risk (FAIR) is a good framework for presenting this information in financial terms for key investments. This framework can be connected to other tools to present a complete picture of the risk and rewards (value) that security produces. Measuring the information over time helps demonstrate how the situation has changed relative to security investments and decisions made by the business. Trend analysis enhances the analysis by showing how much value is produced from reducing risk, increasing operational efficiency, satisfying regulatory obligations, and protecting critical data.

Unauthorized access can expose sensitive company and customer data. Cyberattacks can lead to direct theft or costly recovery efforts. Security incidents can erode trust, impacting customer loyalty and brand value. Attacks can halt business processes, causing delays and lost productivity. Non-compliance with security standards can produce hefty fines. Consequences: Customers may switch to competitors if they perceive them as more secure. Investing in post-breach recovery is often more expensive than proactive security. Investors and partners may question the company's viability after a major incident.

People say they care about risk, but risk bores them to tears. You only get through if you learn to tell a story. There is one critical piece to the story that is always overlooked. Stop wasting your time talking about what's possible. It's very possible a foreign state finds a way to embed code into an M2 chip that happens to be used by the CEO of the company. OK, whatever, this wild crazy talk loses people. Talk what's probable. Any one of the 150 salespeople on our staff can easily have their laptop compromised. An attacker could perform a Kerberoasting attack using a simple free tool off GitHub like GetUserSPNs.py to gain access to the Domain. By the way, Crowdstike is seeing a 583% increase in these attacks. Let's talk solutions.

It's all too easy to fall into the act of spelling out doomsday scenarios. Resist that urge and instead focus on the organization's real goals. Start by listing a few critical operations, then follow that by associating risks that score high in likelihood to those operations. Next, propose security controls that make a tangible impact on that risk and highlight any cost, savings, or training associated with controls and process changes. Finally, estimate the positive impact your proposed solutions will make, such as saving labor, saving cost, or simply providing additional resilience to a core product or result of the organization's functions.

Key stakeholders should already be aware of the risks and consequences of not taking cybersecurity seriously. The goal is to compel them to respond properly to relevant risks presented by security. Decisions about resources and priorities should be driven by the acceptable boundaries of risk taking established by senior management. Security metrics are one of the best tools to highlight risks and they serve as an important decision support system. Metrics should be collected in a way that supports and justifies business decisions about risk management. NIST SP 800-55 is a good standard that outlines how an organization can measure what matters in the security program and help drive action.

ROI Analysis: Highlight potential savings from preventing breaches vs. the cost of recovery. Risk Management: Frame cybersecurity as a key risk mitigation strategy akin to insurance. Brand Protection: Emphasize how strong cybersecurity can enhance brand trust and loyalty. Regulatory Compliance: Point out potential fines and penalties for non-compliance. Operational Continuity: Stress the importance of cybersecurity in ensuring uninterrupted business operations. Competitive Advantage: Showcase how robust security can be a differentiator in the market. Client Trust: Remind them that safeguarding client data boosts confidence and trust.

I once worked for a company that refused to shame or make anyone feel bad about making a mistake. That cultural nuance created great success in our security training. Instead of sending phishing messages to catch people who failed to identify key items from security training, we used messages that made it past our security tools to highlight what attributes in the message were designed so well that people clicked the links or engaged with the content. This approach increased awareness drastically while encouraging people to report everything they encountered. I think the approach worked because people we encouraged to find and report malicious email rather than being afraid to admit that they had fallen victim to an attack.

It is imperative to understand certain basics, and to train others as well. People should know to avoid cyber-risky behavior–such as opening attachments and clicking on links found in unexpected email messages, downloading music or videos from rogue websites, inappropriately using public Wi-Fi for sensitive tasks, or buying products from unknown stores with “too good to be true” prices and no physical-contact information. Information security training materials can be found online–and many are free. ** Never, however, rely on training as a sole line of defense against any substantial risk. **

It’s important to be intentional with a goal of making security a team sport. Make the concepts practical, understandable, and relevant to employees across the company. Ensure that they feel that they can individually contribute through small actions to help reduce risk. Provide bit sized, consistent messaging, across all learning styles to get these key messages and actions across.

Think about the following... When things go bad, and there is some really bad "incident," the information-security team gets blamed. When things do not go bad, however, how often do people thank the information-security team? And, remember, if the information-security team wins 99.999% of battles against attackers, it will get blamed for a breach, and not thanked for preventing 99.999% of possible breaches. This attitude has to change!

What do your stakeholders care about ? Business priorities, reputation, innovation, regulatory compliance, consumer trust, branding, business revenue, ethical and legal practices What do you care about? Making sure none of the above is impacted due to lack of security measures in the organization. Explain your stakeholders how their work can never be successful without security. You can build the most beautiful house but can it retain its value if - it has no locks - house construction is not disaster proof - house is constructed in illegal land

Providing meaningful rewards helps motivate employees to adopt desired cybersecurity behaviors. The value reward will vary based on regional and corporate culture. I have successfully changed security culture by giving money away. We had a monthly reward budget of $1,000. People “caught doing good” received varying amounts of cash based on the significance of the activity. Any balance left at the end of the month was awarded to one winner. The approach built a culture of focusing on doing the right thing. We shifted from cash to public recognition once the desired behavior took hold. $12,000 was a small investment to produce a very valuable outcome that transformed the way the organization valued security.

In my own experience as a CISO, I had to learn two things the hard way: 1. If security is only seen as a "technical thing" rather than as a business partner focused on risk management, you will not have a chair in the C-Suite. 2. If you can't reframe security as a business enabler rather than a cost center, none of your strategic initiatives will get funding or support. Security for its own sake is a career dead end. Always make sure you have OKRs and PKIs for your security programs and that they're tied to strategic business goals. Also, maintain a "career continuity plan" if you find yourself saddled with functional accountability without the authority or influence required to succeed.

Avoid getting lost in presenting "worst case scenarios". Try to be concise and deliver a statement about what business function brings in the revenue and how you're going to make it harder to break, or reduce friction between that function and your planned security controls.

Keep in mind that even a single, short conversation can help employees understand that they are targets, and that thinking about cybersecurity is, therefore, important. People who believe that criminals want to breach their computers and phones act differently than people who don’t understand this reality. Also, when it comes to awareness, keep in mind that it is difficult to secure systems and data when potential users are not fully clear about to which systems they have access, and/or are not fully aware as to what data is in their possession; complexity can easily lead to confusion, and, remains, therefore, an enemy of cybersecurity.