1.2 CYBERSECURITY IS A BUSINESS IMPERATIVE
Executives across every business sector are increasingly concerned about cybersecurity.
After all, reports indicate hacking incidents are on the rise with an estimated nearly
one billion hacking attempts in the final quarter of 2012 alone.2
New governmental laws
and regulations place a premium on cybersecurity controls. Lawsuits lodged in the
wake of cybersecurity breaches continue to mount in volume and damages. Customers, shareholders, and potential investors increasingly are demanding that effective controls
are put in place to protect sensitive information and avoid liabilities. Clients expect that
their personal and financial information will be protected from unauthorized disclosure
and possible exploitation. Executives recognize that their vital corporate information,
such as their intellectual property and trade secrets, provides a powerful competitive
advantage for their businesses and needs to be protected. They want to invest wisely in
cybersecurity, but don’t want to break the bank. Many don’t know how their investments
in cybersecurity draw positive returns. Additionally, because many cybersecurity measures
rely on complex technical controls, many feel uncomfortable with the terminology
of the information technologists, many of whom often focus more on the technology
than the business it supports. The resulting language gaps create barriers that sometimes
produce organizational friction, lack of communication, and poor decision-making.
Discussions with our clients convince us there is an acute and growing need to help
executives understand and cope with the problems posed by cybersecurity issues.
George Polya, a famous twentieth-century mathematician, said the first step in solving
a problem is to understand it.3
We agree and wrote this book in the hope that it would
help executives from all business sectors better understand the nature and extent of
cybersecurity and learn how to train personnel to combat cyber attacks, how to recover
from such attacks, how to prevent infections, and how to best manage their business to
incorporate best practices in cybersecurity.
We propose that the best way to address cybersecurity is to do so from the perspective
of a manager rather than a technologist. Cybersecurity is not solely a technical
issue. It affects every business function. Every activity in virtually every business relies
on information to maintain a competitive advantage. Managers at every level need to
understand how investing in cybersecurity produces effective, efficient, and secure
results. That, in turn, produces value.
As senior executives ourselves, we recognize that a discussion of cybersecurity with
fellow executives should not be too “technical,” because such discussions could diminish
this book’s utility.4
Executives run the entire organization, and they don’t need to be
focused on the coding techniques of their computer programmers. Rather, their job is
to optimize the human and physical resources and assets of the organization in order to
fulfill its mission safely, profitably, and beneficially. We understand that a prime focus of
executives is risk management, and that is where discussions of cybersecurity should begin.
Cybersecurity is about risk management. It is about protecting your business, your
shareholders’ investments, and yourself while maintaining competitive advantage and
protecting assets. It is not just about IT. Rather, it is a multidisciplinary approach to managing
risk, a principal concern of every executive. Note that in addition to Chapter 3.0’s
emphasis on risk management, discussions of risk and risk management are prominently
interspersed throughout this book.