Week after week we read about security breaches in top websites around the world, where millions of user’s data are exposed and the company not even reply with an apology. Until now nobody in management (your typical C-level) assumed any responsibility of the breach, many times due to lack of security, but this tendency is starting to change.
Some CEOs have step down due to high profile security breaches such as Target in 2014 and infamous Ashley Madison just recently, July 2015. Management needs to start speaking cybersecurity and assume responsibility of security breaches.
A security breach can really hurt you – take for example Ashley Madison attack. 36 millions of users data exposed – but let’s be honest, although many of these users were fake profiles, anyway many real users were still affected by the breach. The problem for Ashley Madison is not the attack itself but what has been reveled: the company had plans to go public but by examining the data it looks it was a scam, ouch.
Another recent high profile security breach has been Hacking Team, a security company that develops offensive solutions for LEA and has been selling their products to oppressive regimes worldwide. Hacking Team was a known company for a while of suspicious activities but was not confirmed until a security breach revealed 400 gigabytes of their data containing products source code, client contracts, emails, and much more, the dark side of this company. Really ouch!
MBA schools need to start including cybersecurity awareness into their courses so management understands the problems and how to deal with them. It is not enough to have a good CSO/CSIO these days; management needs to be involved 100%, if not a security breach could hurt your company.
Should high management be involved in cybersecurity matters?
— Simon Roses Femerling – @simonroses
