Cyber Insecurity: Why We Keep Learning

Late last month, the US Securities and Exchange Commission (SEC) approved nonbinding guidance urging public companies to “inform investors about material cybersecurity risks and incidents in a timely fashion.” The guidance, which gives greater urgency to current cybersecurity risks, builds on an earlier document issued in 2011. In the SEC’s words, “Cybersecurity risks pose grave threats to investors, our capital markets, and our country.” A recent report from the Office of the Director of National Intelligence predicts that the world faces “imminent disruption” from cyber threats—potentially on a massive scale with “lethal” consequences.

Meanwhile, not surprisingly, Congress continues to take action on cyber risk, proposing 191 bills so far on the topic.

The imperative for boardrooms to conduct sound cyber-risk oversight is here to stay—in the boardroom and in the halls of legislation. Luckily, resources abound for corporate directors to get up to speed on what their companies need to know and disclose while awaiting regulations and rulemaking about cyber-risk oversight.

Ubiquity of Cyber Risk

The ubiquity of cyber risk poses a fundamental operating problem for all enterprises. Most businesses today depend on digital technologies to operate, which leaves sensitive data and other assets vulnerable to cyber risk. The new Berkshire Hathaway 2017 annual report puts it well. After listing cyber threats in great detail, the report notes that “These are risks we share with all businesses.” Hacking, phishing, malware, viruses—you name it, it’s happening for all of us. Such events can present a material, existential threat to corporations, and possibly could even physically harm the people who work for them or that they serve. That is why Berkshire’s founder and leader Warren E. Buffett has stated famously that cyberattacks are the “number one problem with mankind.”

Directors on Alert

Corporate directors by and large are keenly aware of their companies’ responsibilities around cyber-risk oversight. NACD’s 2017 survey of 660 US public company boards’ members indicated that only 37 percent of directors feel “confident” or “very confident” that their company is properly secured against a cyberattack. This result, which demonstrated lower confidence in a company’s preparation for a cybersecurity incident than in 15 other risk areas, is down from 49 percent the previous year.

Does this mean that companies are less prepared? I read things differently. It means that directors are less complacent.

More directors may be realizing that cybersecurity incidents are inevitable. Directors also are learning more about the topic, with 85 percent of boards reporting at least some knowledge of the topic, up from 78 percent two years before. (In 2015, 22 percent of directors reported that their boards had no or very little knowledge of cyber risk. That dropped in 2017 to 15 percent.)

If you’re feeling either behind or a little foggy on your understanding of these risks, you might consider brushing up with these resources:

• Hundreds of directors have enhanced their cybersecurity literacy through the NACD Cyber-Risk Oversight Program, offered in partnership with Ridge Global and Carnegie Mellon University’s CERT Division of the Software Engineering Institute. More than 175 corporate directors and senior executives have completed the course, the world’s first and only program of its type, while an additional 135 now enrolled in the program are progressing to complete the CERT Certificate in Cybersecurity Oversight.
• NACD offers the Director’s Handbook on Cyber-Risk Oversight, published jointly with the Internet Security Alliance (ISA) and available to all regardless of NACD membership status. The handbook is the most downloaded publication in NACD history, and the only private-sector publication that has been endorsed by the Department of Homeland Security and the Department of Justice, as well as a wide variety of private-sector organizations such as the US Chamber of Commerce and the International Auditors Association.
• ISA and NACD also jointly produce summits on cybersecurity exclusively for corporate boards, where recognized experts and seasoned directors share best practices. As an outgrowth of this initiative, NACD and ISA will cohost our first international dialogue, the Global Cyber Forum, in Geneva, Switzerland, in April 2018.
• Cyber-risk oversight is one of the most popular subjects for directors and advisors writing for NACD’s Board Leaders’ Blog. As you visit this blog you will see I am not the only one writing on the topic. (See, for example, blogs by Corey Thomas, CEO of Rapid7, on the risks of innovation; and Jim DeLoach, managing director of Protiviti, reporting on what was discussed during a director dialogue about cyber-risk oversight.)
• The NACD Resource Center on Cyber-Risk Oversight is a repository of tools and thought leadership that empowers the board to provide effective oversight.

Big Picture

In all these venues, NACD’s resources on cyber-risk oversight keep driving home several key challenges:

• Cyber risk is a global challenge that now threatens to undermine governments, markets, and businesses around the globe. Most cyberattacks are cross-border.
• Cyber risk is also systemic, given our reliance on digital networks and devices for commercial, government, and personal use.
• For corporations, cyber risk is a strategic, enterprise-wide matter demanding active board engagement. Continuous learning is a must, even for specialists, given how quickly technology and threats are evolving.

Questions to Help You Learn About Your Company’s Security Posture

In closing, I’d like to share some applicable questions shared recently with our members in our Weekend Reader e-newsletter. For your next board meeting, consider asking some of these pointed questions to begin establishing a deeper understanding of cybersecurity across the enterprise.

• Which cyber risks are communicated to our company’s shareholders, and in what format?
• Has our management team determined what constitutes a material cybersecurity breach?
• How effective is our internal escalation process when incidents are discovered?
• Have we set clear thresholds for when senior management and the board should be notified?
• How is our company’s cyber-risk assessment process integrated into the overall risk-management process?
• Can material risks be mitigated by insurance, and does the corporation have sufficient coverage?
• Does our company’s cyberbreach response plan include an investor communications strategy?
• Under what circumstances is it necessary to inform law enforcement, customers, and other relevant stakeholders?

While corporate directors have some catching up to do, we’re a community of curious, dedicated professionals. Let’s commit to continuous learning and applying that knowledge to sound cyber-risk oversight. We owe it to our shareholders, our customers, and to the security of our economy.