What does the Boardroom need to know about Cybersecurity?

Ever since the "Year of the Breach" there has been a flood of interest in the question about boardroom knowledge of cybersecurity and the posture of the enterprise with respect to it. The CISO of Target resigned as a result of a breach, but responsibility lies higher in the organization. The buck no longer stops with the technical leadership.

More than five years ago, the New York Stock Exchange Governance Services commissioned a survey of directors of public companies. Two-thirds of the directors lacked confidence in the enterprises ability to properly secure itself. This was despite the fact that nearly one-half of board meetings were addressing cyber security issues. The directors had clearly shifted the responsibility on the CEO of the organization. Years later, major risk insurance providers have placed cybersecurity issues in the list of top concerns for their clients. As recently as last summer, Forbes presented an article about, "Compliance Is Not Security: Why You Need Cybersecurity Chops In The Boardroom."

In forming a center on the Marquette University campus to deal with academic and community needs for knowledge and skills in cybersecurity, we chose the name, the Center for Cyber Security Awareness and Cyber Defense. The intent was to emphasize the need for all to be aware and the need for all to prepare defenses. Our cyber security awareness event two years ago emphasized that cybersecurity was everybody's job. Last year we emphasized educating all in the knowledge and skills that are required.

The world is full of companies marketing technical solutions and their consultancy, but the Directors on the board are lead by the Chief Executive Officer who is to be ultimately responsible for making managerial decisions. Where are the CEOs who are exerting leadership? I see that there are three kinds of postures for CEO's who have taken meaningful action:

1. Those who "got it" and led the discussion inside their enterprise and the Boardroom
2. Those who after observing the risk to the enterprise and themselves "did it"
3. Those who were breached or had a near-miss, but experienced the threat inside their organization and "recovered."

Do you have a story to tell about an enlightened CEO who got it, or one who just did it, or who recovered?

Not every CEO has yet responded to the threats. The community needs to compile the stories and share them so that we can collectively reduce the risk.