Slashdot Mirror
On Cybersecurity, Execs Are Burying Their Heads In the Sand (bizjournals.com)
An anonymous reader writes shares a report on BizJournals: Despite increased spending on cybersecurity, most executives are unprepared, even willfully ignorant, of the threats that could damage their businesses. A survey of 1,530 C-level executives across of range of industries found a widespread feeling that cybersecurity is an "IT problem," even as CEOs personally shoulder the consequences for breaches. "The Target breach was one of the more significant ones: Executives can be held accountable," says David Damato, chief security officer at Tanium. "But there's still that disconnect. Executives still struggle with: 'What should I be looking for?'"
Put the fucking CISO on the executive board.
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
Yes, the technical analysis and implementation of security fixes/updates for hardware and software within a company is a set of IT tasks, but the task of budgeting for that is/should be a finance task, with oversight from C-level legal representation.
If the CEO doesn't know how to handle it, that is fine - as long as he/she understands that they are the ones who will ultimately be left holding the can for a data breach, they will have the incentive to get somebody in place who does know how to handle it - the role of the CEO is to be the figurehead and "big picture" source, not subject-matter expert in all areas.
So the CEO needs to think "this is an IT problem, but I will be carrying the can for a problem, so I need to talk to the head of IT and see what they need to help me save my job", and work from there.
Well, the CEOs can start by looking at their own system account - the one with all the access to private customer data and corporate secrets - and changing the password to something other than '123456.'
What, they won't do that? And it's IT's fault for bitching about it?
Guess the CEO's are fucked, then.
Just yesterday I found a forum post by the former Windows Division president at Microsoft (from 2009-2012 IIRC) talking about how the Commodore 64 was such a great machine because it "was unhackable." He said he had the authority to call it such ~"as CIO of an international Fortune 500 company".
Of course in the replies below were several explanations of many, many hacks that could be used on a Commodore 64 ranging from simple keypresses to complex serial port inputs.
From the standpoint of the CEO, cybersecurity is costly, unlikely to improve earnings or boost the stock price and possibly disruptive to existing business operations. It's much cheaper and easier to purchase insurance against the costs of an attack or breach, should one occur, than it is to be proactive and throw lots of money into techs, consultants and the ongoing costs to deploy, train people and maintain it all. American CEOs are mostly concerned with the stock price in the short term because that is what their compensation is based on. They want to increase the share price as much as possible as quickly as possible with little regard to what the long term outcome will be. These CEOs also know that the average tenure of an American CEO is often less than five years and even if they fail they have a golden parachute clause in their contracts that will allow them to live comfortably for the rest of their lives regardless of what happens. Now I ask you, given these incentives, if you were the CEO, what would you do?
The summary says that many view security as an "IT problem", but it probably fits into the category of IT problems where the real problem is the company's management.
As someone who has worked in IT for decades, I don't think that I've ever seen a security initiative where the biggest challenge wasn't persuading management. The first task is persuading management that security is important enough to even consider. The second is persuading them that it's worth spending any amount of money on, rather than asking IT to do what they can without additional resources of any kind. The next challenge is getting management to listen to security experts rather than going off the CEO's half-baked misunderstandings of how security works. The fourth is convincing them to enforce security policies even in cases when the employees don't like them. Finally, you need to get management to follow the security policies themselves, rather than requiring IT to carve massive holes in the security policy for the CEO's convenience.
In my experience, it's pretty rare that IT departments can make it past the second hurdle-- being able to allocate money/resources to security. Even when they do, the security that gets implemented is often porous and full of security theater.
The question that I always have when reading essays of this type is, what is the appropriate course of action? Setting up business information systems to be thoroughly and deeply secure would take 100% of the financial resources of a good-sized organization and would render the business tools virtually unusable by ordinary human beings. OTOH it is becoming increasingly clear that all of our interconnected systems are penetrated to some degree, including those of the organizations banks, trading partners, and government. If everyone is insecure is there any profit or even any theoretical reason to make ones own systems fortress-like?
That's even leaving aside the question of exactly how an organization would go about this, given that we now know that every firewall and router we use for security has been compromised by national intelligence agencies and it appears that one of the most ubiquitous operating systems has been since 1996 as well.
sPh
Put people in those positions who actually understand everything about the business they are running, and not just privileged douches with zero talents whatsoever.
Once the executive team figures out that IT security is really important they tend to fuck it all up with an endless parade of audits and consultants
Like any parade, it's all for show. These people swoop in, make IT teams fill out questionnaires, conduct interviews, write reports, make recommendations, but nothing real actually gets done. What IT needs are people willing to get their hands dirty and actually help out with these projects. IT winds up having more thrown on their plate without increases in staffing or budget.
Ditch your PricewaterhouseCoopers schmuks and hire someone to actually do the work.
Get off my lawn.
"What should I be looking for?"
How about a competent IT staff that are happy with what they do and don't feel like they're working for bottom dollar.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
I have had five new credit cards issued in the last year. My bank never tells me who screwed up. If I knew what companies compromised my information, I would not deal with them. Let the market put pressure on CEOs to fix their security.
Theatre is great up till the part where what you're protecting has the ability to destroy all kinds of lives then it's a good idea not to wear the blinkers.
New features in a long list--longer than the competition--sell products and increase the status of the engineers and their managers.
Invisible increased security, none.
Engineers are expensive--do you assign a new one to grind out new features--or to security?
Here's another example, the there re over 15 million bitcoin in existence, yet no one has yet figured out and implemented a way to prevent child porn from being irrevocably encoded and broadcast as transaction records in the permanent blockchain. How about state-sponsored fork hijacking? Ought progress on promoting bitcoin cease until all possible exploits real and imagined are mulled and defended against?
Windows is the problem. Always has been, always will be. They've done nothing to address their broken auth system. Every APT and pentest since the widespread adoption of NT 4.0 has been: Own any one workstation or server on a network, dump the cached credentials or crack the local admin account, dump the domain controller, crack everyone's password, lulz, repeat lulz until satistified.
Now, why do businesses run Windows? Office. Seriously the only reason. All other software could just as easily have been written for another platform given that it's 3rd party. Office keeps Windows afloat in business.
Why Office? Calendar and Outlook. The rest are just necessary to be a productivity suite. It's the one piece open source has failed to replicate well.
Do you think that the companies who are outsourcing their IT jobs and network management to companies in India care about security? Anybody have numbers on what percent of breaches are either inside jobs or recently laid-off workers?
Intron: the portion of DNA which expresses nothing useful.
If not on the board, answering to the CFO is a good alternative. The CFO ultimately cares about all things that cost money, and should consider things besides uptime. That was a conflict I'd seen before, where security reports to an operations director, who tends to care about little besides 100% uptime.
Of course it's an IT problem. IT people always seem to think that every IT problem is a #1 priority issue in every organization. The thing is, IT isn't #1 unless it's an IT company. IT keeping things secure is just as important as keeping the physical doors locked. It's important, but it's not the CEO's job, any more than it's the CEO's job to make sure that the locks are working properly on the company's doors.
IT people need to take their heads OUT of the sand, and realize that what they do, while important, isn't any more important than any other pieces of large organizations.
I don't respond to AC's.
Welcome to Capitalism. If there is no money to be made in placing effort to be duly diligent about security, then no effort will be placed. That simple.
That's what the SNAFU is in the U.S.A. and in Canada. I can't confirm anywhere else. I'm in a privileged position to influence and have the ear of some decision making clients on these matters, but if it hurts their pocket, they just stick their heads back in the sand and say "la la la I'm not hearing you." I got paid for providing them advice, they get paid to keep the company afloat by making the tough decisions.
Businesses buy hardware known to only be good for a couple of years, but stretch it for 10 maybe 20 years if they can get away with it.
Ditto for software PURCHASES. Companies stay afloat by continuously resolving crises rather than preventing them.
A strong percentage of businesses rely on I.T. to manage facilitate their workflow, but that doesn't matter. That's life.
I don't agree with this, but that's the observation about those holding the strings to the money purse.
IF GOVERNMENT REGULATION WOULD IMPOSE SOMETHING THROUGH TAX INCENTIVES TO UPDATE HARDWARE/SOFTWARE PERHAPS CYBERSECURITY WOULD BE DIFFERENT TODAY.
When things go topsy-turvy the company will most likely not be punished at all. If punished, it will be a slap on the wrist.
Cybersecurity isn't just not a C-level problem, and even isn't an IT problem, it is simply not a problem.
Make them fully and personably liable. 20 million customer records lost? At lets say 1 million per person? Drain the execs bank accounts, liquidate their assets, seize their trust funds, put their children on the street. Problem FUCKING solved.
Wait... I forgot...... Does Obama dump the screaming new born kids in the fire @ Bohemian Grove during the Cremation of Care Ritual , OR Just the High Priest? Drone The Grove 2016! Yes Grandma, for the last time there will be countless wave after wave of Drones flying above the Bohemian Grove streaming the Cremation of Care Ritual to YouTube and CNN, get over it and take your pills silly...
This should be the title of the article:
On Everything, C-level execs are useless.
Why we still let retarded people with no actual skills run a group of skilled people is beyond reason.
Never met a C-level employee that did more than contribute to global warming and chum-up to the oligarchy.
Worked at one startup where we had no C-level people, and we were very successful and profitable in under 3 years.