How do you convince IT stakeholders and customers to prioritize cybersecurity?

We often forget to address the roots of passion and motivation. Security could be a passion for you, 'learning' might be a passion for few of us, 'driving the business to success' for few others, and 'personal growth and ambition' might drive others. It is ok to not have the same driving factor, but empathy would teach you to tweak your language when you want to influence. Overwhelming your audience with a forced push to accept responsibility won't work, if they don't fully understand what they are signing up for. An organic growth demands constant embracement, especially for security, where a slip is possible by any hand in the whole software lifetime (and beyond).

It all depends on the audience and what matters most, one of the scenarios might work 1. Secure solutions, services or products are more preferred 2.Security is never the priority until you are breached 3. Lose the market or heavy fines due to regulation like the SEC, NIS2, GDPR, PIPL, India's Data privacy act etc ...more coming. 4. Bad press, brand damage,share price taking a beating 5. CISO getting sued getting jailed for not taking his or her job seriously. So security is everybody's responsibility

It is very important for all IT professionals to acknowledge that focusing on cybersecurity provides additional value and trust on the entire IT operations for all involved stakeholders. This focus and effort should not be placed on a best effort and optional basis but as a strategic investment for enhancing the competitive advantage of every organisation.

Understanding the industry and background of the audience can dramatically help when seeking the right words and phrases to translate cyber issues. For many cybersecurity is very vague or unclear, so being able to translate cyber issues into a relatable example to the audience creates a better relationship and increases the likelihood the stakeholders will take cybersecurity seriously.

Cybersecurity should not be considered an add-on, it has to be a proactive approach to incorporate cybersecurity controls deep into the system or infrastructure level processes. Investing in choosing and implementing the right cybersecurity controls/ tools is much cheaper financially than that for suffering data breaches/cyber attacks in the long run.

In dialogues with stakeholders, understanding their inclination to view benefits and risks in monetary terms is vital. The value of implementing cybersecurity measures can vary significantly, depending on the data an organization holds. For a bank safeguarding client financial data, a $100,000 cybersecurity investment may seem prudent, considering a data breach could incur millions in losses. Conversely, a company with less sensitive data may struggle to justify the cybersecurity cost, as the fiscal consequences of a breach may be significantly lower.

A couple of ways to get stakeholders to prioritize Cybersecurity is by raising awareness in recent ransonware cases, providing news articles, regulatory updates and finally showing the financial risks resulting from outdated infrastructure and non-compliance.

To prioritize Cybersecurity is be aware of new treats, monitoring the system. The goal of a good cybersecurity is a good IT teams and good system (even is cheaper).

Know your audience. Freddie Mac for example has different priorities than the Department of Veterans Affairs. The Board of Directors may also have a vision. First ensure you have the vocabulary established and you're speaking the same terms, meaning of those terms, etc. Then you can start to formulate a strategy aimed at meeting the needs of the business. Effective change management starts with your ability to deliver a palatable message to the ones approving your change.

CISO's need to transition from a Security and Complaince mindset to being a part of the customer experience. For instance, a retailer can have over 100+ customer touch points and the cybersecurity function can be a part of three touch points. 1. Creating a secure customer experience online. 2. Protecting the customers sensitive data. 3. Ensuring business continuity that the online experience is highly available 24x7. Be a part of the customer experience and not the nagging cybersecurity department telling everyone not to click on everything. Change the way you operate cybersecurity.

When facing objections, having a proactive and empathetic stance is key. Actively listening and addressing concerns before they become challenges will set the tone for a positive dialogue. Remind them that building a secure environment is like constructing a fortress to protect valuable assets. Emphasize that protecting sensitive data and maintaining security are pillars of success for any organization, just as a strong foundation ensures a building's longevity. Showing potential consequences of security breaches will be enough to handle even the strongest objection. By illustrating cybersecurity as shield against looming threats, you will gain support and reinforce the importance of safeguarding our digital realm.

A common source of objections and misunderstandings about the value of cybersecurity is that some business leaders that do not fully understand: 1. How much business has changed because of technology. 2. How completely dependent most businesses are on technology. 3. The incredible complexity of that technology. We have rebuilt businesses on a web of overlapping houses of cards, and seldom have a viable backup plan for when things go wrong. That has created opportunities for criminals to steal or extort money by making things do exactly that - go catastrophically wrong.

It's essential to be prepared for common objections, such as limited resources or the belief that "it won't happen to us." Provide counterarguments, such as the long-term savings of preventive cybersecurity measures versus the potential costs of a significant breach. Reinforce the idea that cybersecurity is a business imperative, impacting not just IT but every facet of an organization.

You shall do it in an Ideal organisational setup will not always work and the user community will find ways to circumvent the security protocols. The communication and user community buy-in is key for security controls deployment to be successful. showcase the benefits and the security team shouldn't be seen as a road block rather looked upon as an enabler and keeping the organisation safe from the bad guys.

If an organisation has invested in building a cyberculture, the cumulative benefits will ultimately outweigh the investment in training, tooling and implementation of controls. Through active staff involvement, each one will be able to not only fully comprehend the negative effects of cybercrimes but also make others aware of the same in their line of work.

It's already been stated here, but just to reemphasize it's not just about training, it's about building a culture of cyber awareness. Many organizations don't understand why they have failed training exercises. What they are missing is building an attitude of security knowledge not just in the IT department, but incorporating security throughout the entire enterprise. Make training fun, find innovative ways to make your training stick!

I second this opinion. Involvement of stakeholders bring their attention to the presence of cyber threats and risk. In addition to their involvement in the process, they must be exposed to the real world exploits by demonstrating a simulated exercise without their knowledge. It helps in psychometric evaluation of response mechanism and business impact comprehension.

Stakeholders are more likely to buy into the importance of cybersecurity if they feel they're part of the solution. Foster a culture of collaboration and invite input from various departments. By integrating cybersecurity best practices across the organization, everyone plays a role in defending against threats. Demonstrating the required collective effort can help stakeholders understand cybersecurity is a shared responsibility.

Create a network of security champions throughout the business upskill and engage so that they can preach the cyber message, at the end of they day we simply seek to foster secure and resilient business operations, they wouldn’t build a Ferrari and then send it to the safety department to add on some airbags, seatbelts and crumple zones. And neither should IT!!

I also think that sometimes you need to do a live demo which is custom made to your work environment, this makes it easier for stakeholder to have a firsthand glimpse of the added value of Cybersecurity

Continual training and information dissemination are pivotal. Educating stakeholders and customers on the latest cybersecurity trends, threats, and best practices makes them more aware of the ever-evolving landscape. Promote a culture of continuous learning and emphasize the importance of staying informed. Regular updates on the company's cybersecurity posture can instill confidence in stakeholders and customers.

Create a culture of cyber security through the adoption of regular cyber security comms and short monthly educational materials. Cyber is just for October

It's often said that security is everyone's responsibility. Even the most robust and technical cybersecurity solution is no match for human error. This is why it's important to make sure everyone at your organization from the custodian to the CEO is made aware of how their actions can impact your network's security and how the consequences of a breach can impact everyone. Making sure everyone is informed makes it easier to get more buy-in and collaboration from all parties.

And there are two important concepts when considering risk: Risk appetite & Risk tolerance. Risk appetite can be thought of with this analogy: o Risk appetite is like the speed limit on a road. It is the maximum amount of risk that an organization is willing to take. Just like the speed limit, risk appetite can be different for different organizations. For example, a startup might have a higher risk appetite than a large corporation. ? Risk tolerance: o Imagine that you are going to gamble at a casino. You have a certain amount of money that you are willing to lose. This is your risk tolerance. If you lose more than this amount, you will be upset. However, if you win, you will be happy.

You can also align security strategy to the business objectives to make it easier for stakeholders to understand cybersecurity's impact in accomplishing the business goals.

Explain how even small cyberattacks can disrupt IT operations, impacting one or more of - IT/employee productivity, - client confidence - Increased downtime - Reputation etc Additionally, these days cybersecurity is no longer GOOD TO HAVE, it has become MUST have. And hence cyber security has become Competitive Advantage. Position STRONG cybersecurity as a unique selling proposition. Assure stakeholders and customers that the company's commitment to security sets it apart from competitors.