Connect with us

E-Business

Taking Enterprise Security to the Board

Published

on

Anton Jacobsz, managing director at Networks Unlimited

It’s that time of year, again, with many companies busying themselves in the art of budgeting and forecasting for 2018.

 

In some companies, this means the Chief Information Security Officer (CISO) having to communicate the importance of including enterprise security in this planning, using a language that the members of the board will understand.

 

“For some, this will mean being given a short amount of time to make sure a group of non-technical people understand the company’s business risks and believe that your plan to mitigate them is comprehensive, necessary and worthy of investment,” said Anton Jacobsz, managing director at Networks Unlimited.

 

“The keyword here is ‘business’ – we have got to translate our on-the-ground security concerns into business terms, risks and outcomes. We’re all very good at listing statistics but the ability to translate this into business outcomes, which is the language your board understands, is what will win the day.

 

“Your board’s time, attention span and ability to consume ‘geek speak’ is limited, but there are steps you can take to ensure the time you spend with them matters,” Jacobsz explained.

 

Time for a few home truths

Is your exco one of the many that thinks their organisation is not going to be of interest to cyber criminals? If yes, then it may be time to explain clearly that every single organisation, regardless of size or business focus, is likely to  experience a cyber security breach at one point or another. The reason for this is data.

 

If your business processes payments of any kind, for example salaries or online payments, or if you transmit or store records, or if you’re developing a cure for a dread disease like cancer, then you have information that a hacker can sell.

 

Ryan Kearney, Executive Vice President of Product Development and Chief Technology Officer of F5 Networks, advised that telling a compelling story about a security breach, preferably in your industry or locale, will help board members understand the risks here.

 

“Give examples from your own company. Identify critical information assets – intellectual property, sensitive customer data – and paint a picture of what would happen and what it would cost if they were compromised,” he said.

 

Use statistics to convince, not just frighten

There are ways to move the statistics conversation from one that leaves exco with a feeling of dread to one where they truly understanding the real potential impact to the enterprise.

 

F5’s Kearney says the following types of statistics could be used to educate and surprise board members:

 

  • 73 percent of companies suffered at least one security breach in the past year.

 

  • About a third of employees targeted for phishing will open fraudulent e-mails.

 

  • More than one in 10 take the bait – and it only takes one.

 

  • Less than two minutes can elapse from the hacker hitting send to your systems being compromised.

 

  • Hackers are inside your organisation, on average, for at least four months before they’re discovered.

 

  • Web apps are the number one entry point for breaches.

 

“As the C-suite leader in charge of cyber defence, it is up to the CISO to explain the impact of this to the board,” says Jacobsz. “This is the point where you should be talking in terms of tangible and intangible losses, which are sure to resonate with them.”

 

Tangible costs as a result of security breaches include fines as a result of breaks in customer SLAs, revenue losses due to downtime, compliance/audit fines, potential legal fees and incident response costs, which incorporate unplanned costs for hiring third party breach experts.

 

Less immediately obvious damage could include issues like the impact a breach could have on your company’s brand; existing and potential customer perception/loss; the loss of your competitive advantage and even the potential for the board’s personal reputation being affected.

 

Introduce security awareness to the company culture

If you talk of such things around the braai, you might have heard somebody complaining about how their company doesn’t allow Dropbox or Wetransfers – how archaic, right? Wrong, said Jacobsz.

 

“These policies are enforced because someone, somewhere along the lines, opened a mail, clicked on a Dropbox link and downloaded a file from an unknown, untrusted source resulting in a cyber security breach. But this can be avoided. A secure business is one where everyone is educated about threats and does their part to reduce risk.”

 

F5’s Kearney agreed, saying it starts with rigorous and repeated training and continues with individual buy in.

 

Furthermore, as a key participant in creating the company culture at the outset, the board members themselves must also be challenged to champion efforts that have no received budget approval, he said.

 

“You have done your homework and secured funds for some of your efforts but if you have risk areas that need addressing but have no budget allocation, board members need to know this and either accept the risk or champion a solution. There’s no better way to get something accomplished than by saying the board requested it get done.”

 

Discuss incident response and cyber insurance

 

As mentioned earlier, the likelihood of organisations remaining untouched by security breaches is minimal. Being prepared is the best line of defence, and employing the services of a good incident response firm is the first step.

 

The second is considering options in cyber insurance, which is the fastest growing insurance in the world and is projected to grow by 300 percent from $2.5 billion today in annual premiums by 2020. Here, show your work and do the maths for your board – calculate how much your business can absorb and insure the rest.

 

“Use your board-facing time wisely,” said Jacobsz.

 

“Make sure you prioritise and focus on the top cyber risks bringing solutions to the table. Above all, demonstrate your burning issues in small, easy to digest chunks. Do this and you and your boards will soon be singing in harmony and protecting the company at the same time.”

 

 

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

ISPON Makes Case for CPN Affiliates on NITDA’s Board

Published

on

Institute of Software Practitioners of Nigeria (ISPON), one of the affiliate bodies of the Computer Professional Registration Council of Nigeria (CPN), is worried about the continued absence of CPN representatives on the Board of Nigeria Information Technology Development Agency (NITDA), months after the inauguration of its board members, describing the situation as unconstitutional and lopsided.

 

While NITDA is the government agency responsible for the implementation of the country’s policies on Information Technology (IT), CPN is a government agency saddled with the responsibility of registering and controlling all IT practitioners in the country.

NITDA.jpg

The NITDA Act states that four CPN representatives would be on the NITDA Board, which are selected from each affiliate member of CPN, of which ISPON is one of them.

 

This has been the tradition since the inception of NITDA, until this year, when the Minister of Communications, Adebayo Shittu inaugurated the NITDA Board without CPN and its affiliate members, a situation that is giving ISPON and other affiliate members of CPN, some concerns.

 

Worried about the continuous absence of CPN members on NITDA Board, ISPON has called on the minister to quickly address the situation and correct the imbalance, inline with NITDA’s Act.

 

The former President of ISPON, James Emadoye who raised the concern during the official handing over of the administration of ISPON to the incoming President, Dr. Yele Okeremi in Lagos recently, urged the minister to revisit the inauguration and ensure that CPN members are on the Board of NITDA.

 

Okeremi who saw the situation as loss of permanent seats by the CPN, promised to engage the minister until the matter is resolved.

 

Narrating the circumstances that led to the absence of CPN members on NITDA’s Board, Emadoye said: “It is the responsibility of the minister to inaugurate members of the NITDA Board and the minister had called for the list from CPN, which was sent to him before the inauguration, but along the line NITDA instead on quota basis for the selection process and that someone from the North-west must be on the board, which negates the NITDA Act that clearly states that four professionals representing each of the geopolitical group will be nominated to the NITDA Board.

 

Emadoye insisted it was not proper to neglect the affiliates in the inauguration of NITDA Board and called on the minister to revisit the issue and address it amicably.

 

The Minister of Communications had in March this year, inaugurated a team of 16 board members that will drive the affairs of NITDA, without the four representatives from CPN.

 

Since then, stakeholders from the Information and Communications Technology (ICT) industry, have criticised the omission of CPN nominees, while blaming it on NITDA, whom they believed did not handle the entire process of the inauguration with the utmost national interest it deserved.

 

Giving reasons for the omission of CPN nominees, the Director, E-Government Development and Regulation at NITDA, Dr. Vincent Olatunji told THISDAY that the omission of CPN nominees was as a result of a mix-up in the submission of names and that CPN has been further directed to rectify the list of its nominees, and resend same to the minister. According to Olatunji, as soon as the list is rectified and sent, the CPN members would be inaugurated into NITDA Board.

Continue Reading

E-Business

Edo Innovation Hub Partners Siemens on ‘The Hack Edo Series’

Published

on

Sequel to its launch only last week, the Edo Innovates tech cluster has concluded modalities for The Hack Edo Series, a multi-dimensional initiative to identify and incubate the best ideas that tackle problems of power generation and distribution faced by individuals, businesses and the digital ecosystem, with a N3.5 million prize money.

In a statement by Senior Special Assistant (SSA) to the Governor on Skills Development and Jobs Creation, Mrs. Ukinebo Dare, said that The Hack Edo Series which is being organised in partnership with Impact Hub and Siemens Nigeria, will leverage innovation technology to identify solutions in the area of power generation, adding that N3.5 million in cash prizes will be won by the best ideas.

She said starts-ups or groups with ideas can apply on the Edo jobs website, as deadline for application is on June 30.

According to her, “through a series of practical Hackathons, the Hack Edo series aims to equip young Nigerian innovators with the skills necessary to make impact in their various communities.”

She said the series will help increase the number of individuals taking action on social and economic issues, build a collaborative community that tackles issues and identify the best ideas that will be supported through the incubation phase.

She said the hackathons will catalyse high-growth startups within Edo State, support development of ventures from ideation to commercialization and promote job creation and economic development, adding, “this will drive and ensure the increased adoption of local technology by government, corporates and development agencies across Edo state and Nigeria, strengthen and raise the standard of startups in the region and deliver positive social impact returns to communities and people across the region.”

It would be recalled that the Vice President, Prof. Yemi Osinbajo, alongside Governor Godwin Obaseki, last week, launched the South-South Innovation Hub in the state, kicking off activities for the state’s fledging tech ecosystem at the remodeled Institute of Continuing Education (ICE).

The state government has partnered with over 25 technology firms in setting up the facility, which will serve as a one-stop shop for training, incubation, acceleration for start-ups and Small and Medium Enterprises (SMEs) in the state.

Continue Reading

E-Business

ReadyBargains, New Online Shopping Platform Begins Operations

Published

on

 

 

ReadyBargains online business has launched an online platform to allow Nigerians who love shopping online visit shops online, make purchases and get them delivered to their choice locations.

 

“Our goal is to meet the needs of different classes of people looking for good bargains,” Don Okhuofu, chairman, ReadyBargains, said during the launch of the platform recently.

 

“Customers using our platform have access to shop from different UK and US stores using a single cart and a $10 off cart coupon available to the first basket checked out by every customer.

 

“The products are delivered to our customers across the country at their door steps of collection points of their choices,” Okhuofu said.

 

According to him, the platform gives users a 10- 15 percent cost reduction, compared with that of competitors.

 

He noted that all users have access to an additional $10 off every purchases of above $100 made from Walmart, Tesco, Carters and Mothercare.

 

“The risks of getting fake products from our services are remote because users shop directly from the foreign stores themselves. We assure users of quality products because they deal directly with the producers,” he further said.

 

Speaking on the challenging environment for e-commerce operators in the country, Okhuofu stated that the seeming failure of e-commerce business was because of their cost/revenue structure.

 

 

 

Continue Reading

Trending

Copyright © 2017 Communication Week Media Limited.