
Thoughts on Corporate Risk and How Companies are Handling the Challenge
CEOs: Maintain Cyber Resilience While Dealing with COVID-19
What is the relationship between the coronavirus outbreak and cybersecurity? Both require conscious CEO leadership.
Dozens of Texas Cities Suffer Ransomware Hack
Another day, another cyber attack — success for the hackers and another failure by city governments to have adequate protection.
Lawsuit Pins Customer Data Security Responsibility on CapitalOne
When will corporate America and their executives take a serious look at their culpability and liability in data breaches?
Massive Cyberattack Significantly Impacts Credit Risk Ratings for Equifax
For the first time ever, a major credit risk agency slashed a company’s credit rating due to a cyber breach. How can credit risk agencies improve their ability to assess cyber risk?
RIMS2019 Boston: 3 Challenges We Face Today
How Risk Managers Can Manage Cyber Risk
Cybersecurity Breaches Pose Significant Risk to Reputation: A Simple Solution to Ensure Client Trust
Despite being a cybersecurity expert insurer Hiscox Ltd. experienced a data breach. Could Hiscox have prevented this damaging blow to its reputation?
2019 – Make it the Year for Cyber Resilience
Some organizations handled it well, and others had trouble meeting cyber resilience goals. In 2019, make it the year for cyber resilience success.
Cyber Security Reaches Tipping Point (or Critical Mass)
Investment into Business Cyber Security Is Critical for Survival ONE TRILLION DOLLARS. That number should grab the attention of every CEO in America. The breach by Marriott Hotels pushes their potential financial liability to surpass a trillion dollars. The breach...
A Comprehensive Assessment of FFIEC CAT and NIST CSF
What are the differences between cyber assessments from FFIEC and NIST? Can information from one assessment help with the other?
Cyber Risk Success – Best Bet through an Integrated Risk Management Strategy
Recent studies exposed a massive misalignment between security spending and the actual cause of cyber breaches. Two-third of breaches are caused by someone either doing what they shouldn’t or failing to do what they should, yet three-fourths of security spending is on information technology solutions.
Subscribe
Be notified of new Journal entries in your email box or Follow us on Twitter.
Cybergovernance Journal – 11/11/19
October was the 16th annual National Cybersecurity Awareness Month (NCSAM). Read about the results of the first statewide cyber benchmark conducted for the banking industry.
Corporate Law & Governance Update: February 2019
There is a notable increase in governance discourse on the relationship of corporate purpose to sustainable revenue growth, in the context of changing social and political structures.
Cybergovernance Journal – 6/2/18
As we mentioned last month, managing conduct risk can improve attitudes about safe handling of customer data from the executive team down, and it encourages responsible initiatives that increase cyber resilience.
Cybergovernance Journal Update – 4/28/17
Just because insurance companies are gearing up to provide better cyber risk insurance it is still not the best excuse to be lax in cybersecurity practices.
Cybergovernance Journal Update – 4/21/17
Addressing cybersecurity effectively may seem like an undue burden and waste of institutional resources — until you are hit with a breach.
Cybergovernance Journal Update – 4/14/17
Relying solely on your IT department to handle cyber risk governance is asking for financial, legal, and institutional trouble when there is a breach.
Cybergovernance Journal Update – 4/7/17
You can give your IT department all the toys in the world, but that won’t solve your cybersecurity problems or comprehensively reduce your company’s cyber risk.
Cybergovernance Journal Update – 3/31/17
How transparent should your cybersecurity strategy be? Should cyber risk reduction be left in the hands of a few security experts or should it be an organization-wide effort to protect the company?
Cybergovernance Journal Update – 3/24/17
With the NIST framework used to measure federal agencies’ and department’s cybersecurity resilience, is it time for private institutions to gauge their own cyber defenses by the same or similar standards?
Cybergovernance Journal Update – 3/17/17
Not all cybersecurity frameworks are equal. While some companies recognize they need to utilize the most comprehensive plans, others will only implement the bare minimum putting other institutions at risk.
Cybergovernance Journal Update – 3/10/17
On March 16, we will speak and lead a panel at a Skytop Strategies conference on Cyber Risk Governance. Friends of Cybergovernance Journal who want to attend can get a 30% discount. We hope to see you there!
Cybergovernance Journal Update – 3/3/17
With the U.S. Government aiming to require agency compliance with the NIST Cyber Security framework, is making it part of a national cybersecurity regulatory plan that far off?
Cybergovernance Journal Update – 2/24/17
With the average cost of a cyber breach being $4 million (in addition to loss of future revenue and customers), what more motivation do board members need to take cyber risk seriously?
Cybergovernance Journal Update – 2/17/17
In the ever-changing world of cyber risk management, companies and organizations struggle for a way to get best available intelligence to their executive boards.
Cybergovernance Journal Update – 2/10/17
The monthly Cybergovernance Digest – check it out and sign up! Human hacking is one of the easiest ways for agents to create a breach, especially if company culture is not improved alongside technological cyber risk measures. LinkedIn Pulse, Feb. 8The psychological...
Cybergovernance Journal Update – 2/3/17
So you’ve finally committed your organization to a solid cybersecurity plan. How do you plan to monitor progress and find weaknesses?
Cybergovernance Journal Update – 1/27/17
The monthly Cybergovernance Digest – check it out and sign up! The worst way to deal with cybersecurity is to ignore the cyber risk your organization exposes itself to and then cover up evidence of the inevitable breach(es). Cybergovernance Journal, Jan. 23 The term...
Cybergovernance Journal Update – 1/20/17
The monthly Cybergovernance Digest – check it out and sign up! Spooked by data breaches and the bad press that accompanies them? It's never too late to obtain a cybersecurity audit and cultivate cyber risk mitigation habits. Cybergovernance Journal, Jan. 16How do we...
Cybergovernance Journal Update – 1/13/17
The monthly Cybergovernance Digest – check it out and sign up! Cybersecurity vulnerabilities don't just happen at the institutional level, but across interconnected and interdependent systems. A commonly adopted and widely accepted framework could lessen those shared...
Cybergovernance Journal Update – 1/6/17
The monthly Cybergovernance Digest – check it out and sign up! Government action on cybersecurity will be a hot topic this year as many nations focus on systems vulnerable to cyber attack with little in the way of defined policy to counteract it. Cybergovernance...
Cybergovernance Journal Update – 12/30/16
The monthly Cybergovernance Digest – check it out and sign up! While some strides in cybersecurity mitigation have been made in the past year, organizations as a whole still have much to do to keep threat actors at bay. Cyberscoop, Dec. 28It’s that familiar season...
Cybergovernance Journal Update – 12/23/16
Because there is no end point to establishing permanent cybersecurity, it is important to foster an organizational structure that is resilient, aware, and nimble.
Cybergovernance Journal Update – 12/16/16
A security breach can not only impact customer data, trade secrets or national security, it can also effect your company’s sale price.
Cybergovernance Journal Update – 12/9/16
Good cybersecurity planning can not only prevent an embarrassing, and costly, consumer data breach, but secure your intellectual property from theft.
Cybergovernance Journal Update – 12/2/16
As comprehensive cybersecurity practices become better defined we find that the scope has moved beyond organizations to encompass an internet of things; from refrigerators to pacemakers.
Cybergovernance Journal Update – 11/18/16
A strong cyber risk monitoring framework not only protects your organization from attack, but also augments your existing business strategy.
Cybergovernance Journal Update – 11/11/16
With a new incoming administration in the United States comes the possibility of a new direction and focus for government regarding cybersecurity.
Cybergovernance Journal Update – 11/4/16
As cybersecurity of digital infrastructure becomes increasingly vital, spreading risk around continues to be slowed by an ever-changing cyber threat landscape.
Cybergovernance Journal Update – 10/28/16
The insurance industry moving into the cybersecurity arena means the reduction of risk has to become more of a science than art.
Cybergovernance Journal Update – 10/21/16
A large problem in managing cyber risk is creating, and perpetuating, a culture within an organization that is security-aware.
Cybergovernance Journal Update – 10/14/16
Government bodies are working to ensure organizations build solid cybersecurity plans, which requires a board of directors who are committed to implementing them, which requires a cyber risk team that can provide actionable intelligence.
Cybergovernance Journal Update – 10/7/16
“Inconvenience,” hopelessness, or outright ignorance is not valid basis for cybersecurity strategy — especially when expert help is readily available.
Cybergovernance Journal Update – 9/30/16
As cybersecurity increasingly becomes a matter of national security, governments at the national and state levels vie to find regulatory solutions.
Cybergovernance Journal Update – 9/23/16
“Based on Gartner, NIST says 30% of U.S. organizations used the framework in 2015, and it expects usage to grow to 50% by 2020″
Cybergovernance Journal Update – 9/16/16
With multiple risk assessment frameworks available it’s time to evaluate which plans provide the greatest benefits, and which give a false sense of security.
Cybergovernance Journal Update – 9/9/16
Cybersecturity isn’t just protecting your technological infrastructure, but creating an organizational culture resistant to human hacking.
Cybergovernance Journal Update – 9/2/16
As the cybersecurity market matures and grows, some organizations are refining their policies while far too many are still lacking any policy at all.
Cybergovernance Journal Update – 8/26/16
Lax cybersecurity practices are increasingly becoming more of a liability for companies. Rather than being forced to by law or threat of legal action by stockholders and customers, a proactive company can get ahead of the coming regulatory curve. Cybergovernance...
Cybergovernance Journal Update – 8/19/16
>Keeping up with every external threat to your organization can be a Sisyphean task. Ensuring your company’s cyber resilience by focusing on internal practices in addition to physical infrastructure is achievable.
Cybergovernance Journal Update – 8/12/16
If organizations are hesitant or, worse, resistant to shoring up their cybersecurity practices, their insurance company and public shame may force them to.
Cybergovernance Journal Update – 8/5/16
With signs of a “cyber jihad” coming because of a mature hacking marketplace, organizations need to do more than rely on automated systems to protect themselves.
Cybergovernance Journal Update – 7/29/16
One of the problems of cybersecurity is that an assessment is a snapshot within a rapidly changing environment. This makes choosing a solid, reputable method of assessment for your organization all the more important.
Cybergovernance Journal Update – 7/22/16
Many companies still view cybersecurity as an IT-only problem. However, those who implement it with a holistic, institution-wide plan also reap the benefits of increased operational excellence.
Cybergovernance Journal Update – 7/15/2016
It’s not recommended, when you are hit by hackers, that you cover it up to avoid liability. It’s better to have a comprehensive, holistic cybersecurity plan that is more than software plus the IT department.
Cybergovernance Journal Update – 7/8/2016
At the federal and state levels, the U.S. government is making several moves to assist cybersecurity best practices; by establishing a federal CISO, ongoing cyber dialogs with China and increasing use of private, secure cloud networks for state business. Cybernance...
Cybergovernance Journal Update – 7/1/2016
There is growing acceptance that cyber risk is a part of doing business. But how can a company or organization accurately gauge an acceptable level of risk?
Cybergovernance Journal Update – 6/17/2016
The quantification of cyber risk is a hot topic as companies and organizations seek to insure themselves against security breaches.
Cybergovernance Journal Update – 6/10/16
One of the more common cyber attacks, phishing, is on the rise and many times it is coupled with ransomware. This is one of many reasons that, by 2020, most digital businesses will be affected by major service failures.
Cybergovernance Journal Update – 6/3/2016
The $18M bank heist in Bangladesh is a case study in the result of not having a comprehensive cybersecurity plan in place. But which plan is best? NIST? The developing European approach? LinkedIn Pulse, May 31, 2016The NIST Cybersecurity Framework has won universal...
Cybergovernance Journal Update – 5/27/2016
The vast majority of companies continue to be unprepared for cyber breaches, but will the passage of a “Sarbanes-Oxley” bill for cybersecurity provide the guidance and motivation to get them secure?
Cybergovernance Journal Update – 5/20/2016
From a mixed Obama legacy on cybersecurity to institutional standards implementation to declaring cyber warfare, the US government is struggling to deal with cyber risk.
Cybergovernance Journal Update – 5/13/2016
Cybersecurity leadership from an organization’s board is necessary to combat rising cyber risks like ransomware.
Cybersecurity Governance News – 5/6/2016
Being prepared and following best cybersecurity practices is the first step in preventing your data being stolen and sold on the dark web. SC Magazine, May 4Hold Security said the batch came from a “Russian kid” that one of its analysts found who had gathered 1.17...
Cybergovernance Journal Update – 4/29/2016
Unprepared executives, losing sleep from cybersecurity issues, some not being able to read a cybersecurity report, are a cyber risk, not only to their careers but to their organizations.
Cybergovernance Journal Update – 4/22/2016
One of the best markers that cybersecurity is rising in importance is looking at how the insurance industry is reacting to cyber risk. Another is to observe how national governments are reacting, or failing to act.
Cybergovernance Journal Update – 4/15/2016
The price of reducing cyber risk is constant vigilance. It is not a duty reserved for the IT department or a few executives, but an organization-wide effort of compliance and training.
Cybersecurity Governance News – 4/8/2016
Cybergovernance is slowly maturing with the refinement of the NIST framework, strategies to fill security positions and increasing awareness that the entire organization is responsible for cybersecurity.
Cybersecurity Governance News – 4/1/2016
Cybersecurity awareness continues to rise; and with it the realization that the business world is far behind. Shortages in security talent has driven salaries up and boardroom governance is still below where it needs to be.
Cybersecurity Governance News – 3/25/16
Mounting cyber risks are reaching the point where they adversely effect insurance ratings. The entire organization must be involved in preventing breaches.
Cybersecurity Governance News – 3/18/16
While a new crop of MBAs specializing in cyber security analytics are being trained, current executives still need to protect themselves and their companies. Basic cybersecurity practices are easy to implement, but comprehensive implementation requires a challenging amount of organizational discipline.
Cybersecurity Governance News – 3/11/16
Personal and corporate liability for breaches is a hot topic and action is being taken by the financial industry.
Cybersecurity Governance News – 3/4/16
The technological elements of cybersecurity remain the easiest to regulate and build. The human elements, on the other hand, require changes that many companies are too slow in adopting.
Cybersecurity Governance News – 2/26/16
Ensuring cybersecurity is relevant and important to everyone in your organization, not just the IT department, is a challenge.
Cybersecurity Governance News – 2/19/16
Turning cybersecurity theory into practice is a challenge in the government and business spheres. The real world consequences of overconfidence in partially implemented plans can lead to ransomware demands and data breaches, putting CEO and Boards at risk of litigation.
Cybergovernance Journal Update – 2/11/2016
NIST Framework is gaining traction in government circles, but companies are still falling short of comprehensives solutions; instead relying on periodic risk assessments or throwing more experts at the problem. Financial Times, Feb. 11 Mr. Weil says companies need to...
Cybergovernance Journal Update – 2/5/2016
Regulations, periodic assessments and theoretical models can only lead the way to a partial, but not comprehensive, cybersecurity solution. This is especially true when it comes to making cybergovernance accessible to executives — until now.
Cybergovernance Journal Update – 1/29/2016
As security breaches, especially from state actors like China, increase risk, technological, legislative and framework strategies are evolving to counter them.
Cybergovernance Journal Update – 1/22/2016
While state actors plot further government and corporate breaches, strategies are being further refined to deal with them. Cybersecurity responses are moving from ineffective single-point plans to comprehensive structural risk responses.
Cybergovernance Journal Update – 1/15/2016
Companies and government entities started the year by better defining cybersecurity and how to protect themselves from cyber attack.
Cybergovernance Journal Update – 1/8/2016
The holidays were, once again, an unhappy time for corporate cybersecurity. 2015 also saw most organizations lacking comprehensive cybersecurity.
Cybergovernance Journal Update – 12/18/2015
Latest news and opinion on cybersecurity governance from Cybergovernance Journal
Cybergovernance Journal Update – 12/11/2015
More companies around the world are coming to realize how vulnerable they are to cyber attack. Recent articles discussed legislation aimed at ensuring cybersecurity standards are met, vulnerabilities to national infrastructure and to businesses, and how cyber affairs...
Cybergovernance Journal Update – 12/4/2015
Cybergovernance is a hot boardroom topic – globally! The consensus is that success in mitigating cyber risk must involve an increased level of understanding by executives and board members, and increased education and awareness throughout the organization.
Cybergovernance Journal Update – 11/27/2015
As more breaches happen and shareholder lawsuits follow, discovering how your organization as a whole, not just the technology team, deals with cybersecurity grows in importance. Directors must also understand how data must be handled in order to combat global espionage that is growing with the rise of global workforces.
Cybergovernance Journal Update – 11/20/2015
The visibility of cybersecurity breaches as a source of corporate risk continues to grow. Recent articles discussed adding cybergovernance experts to boards, regulation in the financial services and healthcare industries, and worldwide concern for better security and...
Cybergovernance Journal Update – 11/13/2015
Members of the U.S. futures market will soon be measured against heightened cybersecurity standards geared towards enhancing incident preparation, prevention, and response among industry participants regulated by the National Futures Association (NFA) Read Article...