Are Your Executives Taking Cybersecurity Too Lightly?

A quick search of data breaches in 2019 will reinforce the fact that cybersecurity is directly tied to a company’s brand reputation. Facebook, LabCorp and Marriott are just three well-known brands that have been forced to deal with the fallout of major data breaches in 2019. When your brand’s reputation is damaged, it inevitably affects your bottom line.

You’d think cybersecurity would be a top priority for senior business executives who are charged with protecting and enhancing the value of a brand. You’d think executives would be demanding more robust security capabilities. You would think. But you would be wrong.

In fact, 61 percent of cybersecurity professionals who participated in a recent survey said they work with C-level executives who expect more lenient security policies for themselves than for other users. Given the constant headlines about data breaches and the fact that senior executives are considered high-value targets, shouldn’t the opposite be true? Shouldn’t executives require stricter security for all users, including themselves, to reduce the risk of a data breach?

Not surprisingly, this disparity between what should be and is not results in 65 percent more data breaches.

The sad reality is that weak cybersecurity is a gamble too many executives are willing to take, often in the name of convenience or cost reduction. In other cases, they simply don’t understand the consequences of security incidents. In either scenario, executives are making bad decisions that increase overall business risk. They usually don’t see the impact of these bad decisions until they review financial reports in the months following a data breach.

As important as it is to implement the right security tools, you need to build a security culture first. More than technology, people are often the strongest defense against security threats – and the weakest link. Culture has to start at the top with senior executives.

If security is going to be a top priority, executives need to understand the state of their security infrastructure. A comprehensive risk assessment, performed by an outside party with enterprise-level security expertise, will tell you what tools and protocols are in place, what they do, how effective they are, where vulnerabilities exist, and the likelihood of a successful attack. Executives should use this information to determine what level of risk is acceptable and which threats could present the greatest harm to the business and the brand.

To enact meaningful change and improvements in security, there needs to be ongoing dialogue between senior executives and IT. The job of IT is to identify risks, set priorities, recommend where investments should be made, and carry out the strategy. Executives need to support and review risk assessments, establish goals, and hold all parties accountable in reaching those goals. Executives and IT also need to collaborate to develop training for employees on security best practices and make sure a culture of security extends across the organization.

If security is a blind spot for the leadership of your organization, take action now instead of waiting for something bad to happen. Let us assess your environment and help you implement the necessary changes to reduce risk and make IT security an organizational priority.