By Chris Morrison, Workflow contributor
- Security teams need people who understand tech and can communicate effectively with non‑technical colleagues
- A council made up of execs from across the company can help elevate the importance of security
- Emerging software tools can help compensate for overstretched staff
Cybersecurity has never been a more vital business issue. While the growth of cybercrime has been noted for years—in 2021 alone, one study found intrusions increased 50 percent from the year prior—trends like work-from-home, migration to cloud, and geopolitical instability have led to a qualitative spike in risk.
Weak cybersecurity can cost a business plenty. While the average cost of a breach across all company sizes and industries was $4.35 million in 2022, the largest breaches averaged $387 million when taking into account detection, response, regulatory costs, and lost business, according to a report by IBM. So it’s increasingly imperative that companies approach their cybersecurity organizational structure deliberately.
Yet doing so has become increasingly complex.
The challenge goes beyond the highly publicized cybersecurity talent shortage. It begins at the top, with the chief information security officer (CISO). Some companies still don’t have this role; those that do range in how they establish its reporting structure and responsibilities, each trying different approaches based on their varied and changing attack surfaces.
In short, there is no one-size-fits-all structure to a cybersecurity organization. But several models that have emerged from the most-attacked industries point the way to one that communicates and acts effectively across all business levels. Here are the key roles for a strong cybersecurity operation built to keep an organization secure.
The first-ever CISO, Steve Katz, was hired by Citicorp in 1995 after the bank was the target of significant cyberattacks. Katz reported to the CTO. But as the role evolved, a debate emerged in the cybersecurity industry about whether the CISO should instead report to the CEO to signal its importance and dispel notions that cybersecurity was merely a subset of IT.
Today, that debate has become more nuanced. Many security experts believe that CISOs work best when closely tied to IT. As a result, most CISOs report to a CTO or CIO. At the same time, CISOs have also gained board-level visibility.
A 2021 survey of CISOs by executive search firm Heidrick & Struggles found that 90 percent present directly to the board or its audit committee.
This ability to take security issues directly to the top could soon become law for large companies—the Securities and Exchange Commission recently proposed a new rule that would require reporting on how corporate boards oversee their cybersecurity risk.
The CISO role is also widely acknowledged as being difficult to hire for, which is why some firms have begun adapting the position to individual candidates. For instance, someone with significant cybersecurity chops but less direct experience in a business vertical could still get hired and receive support to supplement the domains where they are weak.
“The org chart and the way the CISO’s function is structured should depend, to a degree, on the individual,” says William Beer, the North East financial services security lead for Accenture. But it’s a risky proposition, given the high turnover among CISOs. “You could argue that if the average tenure of a CISO is 18 months, that could mean a lot of organizational change as you swap in CISOs. But I’m hoping the general trend of the life of a CISO is expanding.”
A steering committee for cybercrime is a must-have. Such a group can go by varying names such as the security executive council or the enterprise risk committee. Its purpose is to bring together stakeholders from different parts of an organization, including the COO, CIO, general counsel, and division leaders. Many companies also place board members on such committees.
At its best, a steering committee helps enact plans for managing vulnerabilities and incident responses, as well as facilitating communication between business unit leaders and the CISO.
$4.35M
the average cost of a breach across all company sizes and industries in 2022
“You can’t say, I’m just going to hire a CISO and they’ll make things secure, nobody else has to do anything. That doesn’t work and you’re going to pay for it if you try,” Rosenquist says.
However, some committees end up being ineffectual. Why? Because they lack clear operating procedures or authority to force compliance with new policies. Kayne McGladrey, who consults with individual clients for the security firm Hyperproof, recommends reviewing corporate governance procedures to ensure that a committee can have real clout. “If it doesn’t have the authority to make independent decisions, you can have a lot of smart people who make recommendations that go nowhere,” he says.
Get Workflow in your inbox
Trending articles
Related
Facilitate Collaboration Between IT Operations Management and Security Operations with AIOps
Related articles
Author
Chris Morrison is a freelance writer who has covered technology topics for the Economist, VentureBeat, TechCrunch, and other publications.