{"id":211876,"date":"2023-08-11T15:44:17","date_gmt":"2023-08-11T15:44:17","guid":{"rendered":"https:\/\/dominiclevent.com\/blog\/?p=211876"},"modified":"2023-08-11T15:47:21","modified_gmt":"2023-08-11T15:47:21","slug":"three-ways-cisos-can-lower-the-risk-of-personal-litigation","status":"publish","type":"post","link":"https:\/\/dominiclevent.com\/blog\/three-ways-cisos-can-lower-the-risk-of-personal-litigation\/","title":{"rendered":"Three Ways CISOs Can Lower The Risk Of Personal Litigation"},"content":{"rendered":"

Michael Nicosia, COO and co-founder at <\/em>Salt Security<\/em><\/a>.<\/em><\/p>\n

\n

We live in a litigious world, and the technology industry is no different. Almost as soon as Meta released Threads, Twitter threatened a lawsuit. Meanwhile, an ongoing antitrust battleground is the norm for the most prominent global technology companies, including Google, Alphabet, Amazon and Microsoft, amid M&A activities. Other technology and VC companies have also spent their time in the courtroom as a result of charges related to gender and racial discrimination.<\/p>\n

However, there\u2019s a new litigation trend in town with disturbing ramifications. Several high-profile CISO\/CSO lawsuits have hit the news recently, with executives under fire because of security breaches and response failures.<\/p>\n

In the case of former Uber CISO Joseph Sullivan, the government held him accountable<\/a> “for his role in covering up a 2016 data breach” that exposed the personal records of tens of millions of Uber users. Sullivan ended up with a $50,000 fine and three years of probation<\/a>.<\/p>\n

 <\/p>\n

More recently, SolarWinds found itself in the hot seat from the 2020 SUNBURST supply chain attack, which put companies and government agencies using its Orion software at risk. In this case, the SEC sent Wells notices<\/a> to several SolarWinds employees in June 2023, indicating it plans to take enforcement action.<\/p>\n

Security leaders are worried. In a 2023 global survey of 300 CISOs\/CSOs<\/a>, commissioned by Salt Security and conducted by Global Surveyz, respondents cited concerns over personal litigation stemming from breaches as their number one personal challenge. At a time when the role of the CISO is more important than ever, CISOs may choose to decline top job offers or require indemnification or insurance, creating other business needs and challenges.<\/p>\n

Lowering Your Risk<\/h2>\n

By taking the following steps, however, organizations can help alleviate some of the growing concerns and risks.<\/p>\n

1. Create a collaborative culture when it comes to security.<\/h3>\n

No single person should be the scapegoat for a security breach. Culture is built from the top down. The entire C-suite and board of directors must voice the importance of security to all cross-functional departments. Everyone has an obligation to contribute to the safety and security of an organization as well as its data and business assets.<\/p>\n

In addition, organizations must develop a comprehensive security incident reporting process that provides documentation about the chain of events and ensures that other stakeholders\u2014such as the board, other C-level executives and cybersecurity working groups\u2014are fully informed should any issues unfold. With increasing security risks all around, these protective measures should be in place at every organization.<\/p>\n

2. Enforce a strict policy of transparency regarding security breaches.<\/h3>\n

If a security incident occurs, organizations must be transparent about the event, sharing information immediately with those impacted and providing advice and an open line of communication about necessary protective measures until the threat is contained.<\/p>\n

The policy should include both external and internal communications as part of the disclosure process. There’s no shame in quickly acknowledging and rectifying an identified problem.<\/p>\n

3. Consider solutions with the visibility to defend against the most significant potential threats.<\/h3>\n

CISOs must be equipped with security tooling that provides a complete view of all the dispersed yet intertwined risks within an organization\u2019s APIs, applications, infrastructure and data stores. These insights and visibility empower CISOs to demonstrate their success in lowering security control gaps and mitigating security threats.<\/p>\n

Unfortunately, there are many times when CISOs struggle to gain stakeholder support for what’s needed. In the aforementioned CISO 2023 survey, over one-third of CISOs worldwide said they had difficulties justifying the cost of security investments<\/a> to cover increasing risks.<\/p>\n

Stopping The Blame Game<\/h2>\n

CISO concerns over personal litigation stemming from breaches must be addressed. Top security leaders shouldn’t be held solely accountable for breaches instigated by cybercriminals. This is especially critical, given that security threats will only continue to increase in the years and decades to come as cybercriminals employ new methods and technologies, such as AI, to attack and infiltrate organizations.<\/p>\n

Business leaders have a duty to shoulder the responsibility in addition to the CISO and to guarantee processes are in place to support the ability to do so. Organizations must show integrity by being open about possible security incidents to protect everyone who may be impacted by them. Most of all, businesses need to give their security teams the budget to procure the solutions and build the team required to be effective in their job\u2014to defend an ever-growing attack surface from bad actors who are using new tools to wreak havoc. By doing so, organizations can lower allegations of negligence and demonstrate they have taken all precautions available to protect infrastructure and critical data.<\/p>\n

\n

Forbes Technology Council<\/a> is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?<\/em><\/a><\/p>\n

\n<\/div>\n\n

Source link <\/a>
\n\"\"<\/a><\/p>\n