Almost since the birth of computer networking, engineers who build and manage computer systems have needed to figure out how to protect them from both intentional attack and unintentional damage. The deeply technical realities of securing computers and networks created a need for security specialists. Recently, the costs and other implications of attacks have created a seismic shift in how businesses must think about cybersecurity. Responsibility for cybersecurity has expanded from the IT engineer to the boardroom, and it’s not going back.
This past week, Cisco published its Annual Security Report. One of the key areas Cisco calls out is “Changing the View Toward Cybersecurity—From Users to the Corporate Boardroom.” The report highlights the increasing importance of security not only within the technical ranks, but also as part of an organization’s strategic oversight. In fact, according to Cisco, “Strategies include considering new approaches to help align people, processes, and technology, making security a topic at the corporate boardroom level, and adopting more sophisticated security controls…”
As I speak with executives and board members of major enterprises, I’m increasingly hearing the same thing: they agree that it’s time for them to understand how their assets are protected, how their security investments are used, and how their networks are being protected before, during and after attacks. Given the complexity of today’s networks, providing them with answers requires automation. Networks aren’t static because businesses are not static. Useful answers need continual assessment and at least daily reports –describing the changes in the enterprise’s risk profile, access paths, and threats. When changes occur, the CEO must ask the question, “Is my network more protected today than yesterday?”
As Cisco’s report states, “The future of cybersecurity hinges on boardroom engagement today.” That engagement requires goals and standards, clear communication, succinct information, and continuous improvement in the face of ever-changing business requirements. Furthermore, the report makes clear the questions that the organization must be able to answer: “Boards also need to start asking tough questions about security controls: What controls do we have in place? How well have they been tested? Do we have a reporting process? How quickly can we detect and remediate the inevitable compromise? And perhaps, the most important question: What else should we know? CIOs need to be prepared to answer those questions from the board, in terms that are meaningful and understandable to board members, and also outline implications for the business of any proposed changes..
With RedSeal, you are able to answer those questions, and not merely in terms of the intended design, but in terms of the reality of your network today. Is your network RedSealed?
