What do you do if your boss doesn't take information security risks seriously?

Enfatize que um investimento proativo em segurança da informação pode prevenir riscos, protegendo os ativos mais valiosos da empresa: seus dados e sua reputação. Você também pode argumentar que medidas de segurança robustas podem oferecer uma vantagem competitiva, ao demonstrar aos clientes e parceiros o comprometimento da empresa com a proteção de informações sensíveis. Também traga para a conversa casos reais de empresas que tiveram prejuízos milionários por não terem investido em Segurança.

Se seu chefe não leva a sério os riscos de segurança da informação, comece avaliando os riscos, utilizando técnicas de quantificação de riscos cibernéticos como CRQ. Para isto, o framework Open FAIR, disponível também em português, apresenta os resultados da análise de forma clara e objetiva, em formato monetário.

A Segurança da Informação ainda é vista com ressalvas por muitas empresas aonde TI ou Segurança não são cores. Muitos gestores por temerem embates com o board sobre questões de segurança acabam sendo omissos, não tratando o tema com a devida importância, expondo o negócio a riscos. Algumas empresas por onde passei durante minha jornada eram líderes em seu segmento de atuação, porém não possuíam uma cultura de proteção de dados, mesmo sob os riscos de exposição e multas oriundas da LGPD. Não é fácil mudar uma cultura corporativa se não há um comprometimento do topo da pirâmide. Mudar essa cultura é um dos grandes desafios do CISO nas organizações.

Ownership and accountabilty of known risks needs to be taken seriously regardless of your role. Once a risk is discovered it cannot go away. So you have 4 choices: - Mitigate it - Accept it - Assign it - Ignore it If your executives decide to ignore a risk you should present them with a Risk Letter. This is a document that outlines the data of the risk, the effects of the risk on the business if exploited and a statement that the Executive knows that this is a risk and is accepting it. This letter helps your auditors to know that you have addressed it, that the business understands it, and that you as the CISO can address other risks that are more important to the company.

Acredito que o melhor caminho é utilizar exemplos reais, e próximos (caso tenha), eu utilizaria dados que destacaria a relevância e o impacto dos riscos de segurança. Talvez uma matriz de risco detalhada, poderia trazer uma visão mais clara da posição atual e das áreas que necessitam de atenção urgente. Uma coisa que eu utilizo também é levar o problema já com a solução. Você levar para o superior apenas um problema, vai entrar na fila dele de problemas e esse pode nunca ser priorizado, agora se levar o problema já com uma sugestão de resolução, pode já sair priorizado e não cair no baú do esquecimento rs.

Document the risk, vulnerability data, potential impact on the business, and proposed mitigations so that they have a holistic reporter. This way, they can make a risk-informed decision.

Here's what you can consider to do: Document Concerns: Compile evidence of where security risks are being overlooked or not adequately addressed. Educate: Provide your boss with educational materials or presentations highlighting the importance of information security and the potential consequences of neglecting by it Communicate: Schedule a meeting to discuss your concerns with your boss, emphasizing the potential impact on the company's reputation, finances, and legal liabilities. Offer Solutions: Propose practical solutions or improvements to enhance information security within the org. Ultimately, it's important to advocate for a culture of security within your organization to protect sensitive data and mitigate potential risks.

Cuando encuentras resistencia por parte de la dirección sobre la importancia de los riesgos de seguridad de la información, es clave enfocar la situación hacia la educación y el liderazgo en ciberseguridad. Prepara ejemplos y estudios de caso que ilustren las graves consecuencias de no atender adecuadamente estos riesgos. Implementa sesiones de capacitación sobre seguridad de la información con expertos, resaltando que el viaje hacia una ciberseguridad debe ser liderado por la dirección. Su compromiso y participación activa son fundamentales para prevenir incidentes de seguridad, los cuales pueden tener un impacto financiero y reputacional significativo. La buena ciberseguridad ahorra dinero e incluso se convierte en vector de negocio.

Document the risks you see and, where possible, find cases or articles about what happened to other companies where these types of risks were not properly addressed. Approach with an "I don't want this to happen to us" attitude.

Finding a problem is easier than finding a solution, most managers believe in focusing on issues which can be fixed rather than investing time in trying to solve something that might be impractical to improve. A good strategy is to find a way to improve the issue while explaining why this problem is important, as well as present the financial impact of the current problem and its solution. This way you will have a strong position to obtain the resources to implement your solution

Algumas empresas ainda acreditam que apenas Firewall e Antivírus são suficientes para proteção do negócio. Outros acreditam que Segurança é responsabilidade de TI. Precisamos mudar essa cultura e mostrar que segurança é de responsabilidade de todos! Pequenas ações no dia a dia ajudam na proteção. Um usuário que abre a porta para um estranho, ou empresta o crachá para que outro acesse um local restrito, ou deixa seu crachá sobre a mesa quando se ausenta pode ser um risco para todo o negócio. Enquanto o RH não guardar os currículos em gavetas ou o financeiro guardar os contratos em armários ao invés de deixa-los sobre a mesa, não avançaremos em questões mais avançadas.

Suggest practical solutions to mitigate risks. These could include implementing stronger access controls, regular security training, and robust incident response plans. Engage Leadership: If your boss remains unconvinced, escalate the matter to higher management or the board. Present a compelling case for investing in information security. Remember that persistence and clear communication are key. Advocate for security measures that protect both the company and its stakeholders.

This can be tough. Having a good team of professionals will help you identify solutions by either reconfiguring current tools or help identify tools that need to be acquired.

It is not enough to bring solutions, you also need to be able to break apart the remediation tasks into reasonable chunks of work and help prioritize them. It is very easy for teams and managers to become discouraged by the endless demands of keeping up with security if there is a constant fire hose of things they need to fix, and everything is high priority.

Leave. Find another job. This organization is going down in a bad way. Why stay if your boss is a moron? If all else fails, get them intoxicated and get pictures with barnyard animals.

I opened my own firm to champion a culture of robust information security practices. However, if faced with a scenario where my boss doesn't prioritize information security risks, I'd initiate proactive discussions. By highlighting the potential consequences and offering actionable solutions, I aim to cultivate awareness and collaboration towards safeguarding our assets. If necessary, I'd escalate concerns to higher management or advocate for dedicated training and resources. Ultimately, ensuring the protection of sensitive data and maintaining trust with clients remains paramount in any organizational setting. #InformationSecurity #RiskManagement #CybersecurityAwareness #WyvernSecurity

Find someone in the board who can understand the cybersecurity risks. Speak her/his language. Once a board director is involved, suggest a tabletop exercise to let senior management “feel the pain”.

Identify influential stakeholders within the organization who share your concerns about information security. Collaborate with them to build a coalition advocating for improved security practices. Present a unified front when discussing security issues with your boss, leveraging collective influence to convey the importance of prioritizing information security. Highlighting industry standards, regulatory requirements, and competitors' security practices can further bolster your arguments and strengthen your influence.

There are plenty of effective ways to "activate" the top of the organization when it comes to cybersecurity, even if your Board or Execs aren't tech-savvy. One of the most effective ways to do so is to bring in an outside resource to speak to the Executive Team or Board. You can leverage experts in the field or even contact your local PD (they're involved with cybercrime) or even federal agents (FBI or the Secret Service). Most law enforcement agencies will come and speak to your business and/or customers (if you want to make it an event). Additionally, there are other businesses in your community that have been victims of cybercrime. See if someone is willing to come tell their story. These stories always open up a lot of eyes.

Maintain thorough documentation of your communications regarding information security risks and your efforts to address them. Keep records of risk assessments, proposed solutions, and any responses or decisions from your boss. Documenting concerns serves multiple purposes: it provides a clear record of the security landscape, demonstrates your diligence in addressing security issues, and serves as a reference point for future discussions or audits. Additionally, it provides protection in case of future incidents by demonstrating that you took appropriate steps to raise awareness and mitigate risks.

To document information security concerns: 1. Outline Concerns:Clearly state vulnerabilities and risks. 2. Provide Evidence:Include supporting data or incidents. 3. Highlight Impact:Describe potential consequences succinctly. 4. Propose Solutions:Offer actionable recommendations. 5. Include Stakeholder Input:Briefly incorporate security-conscious views. 6. Record Discussions:Document conversations concisely. 7. Request Action:Clearly state desired outcomes. 8. Plan Follow-Up:Outline monitoring steps briefly.

Document your concerns to your boss thanking him for taking the time to listen to you. Once again, pitch your solution, how you believe it will benefit the company, and explain the potential risk of doing nothing. After all that, you cannot care more than your bosses. As some others suggested, you can talk to your peers to build consensus. Talk to your bosses peers to see if there may be interest in fixing the problem in other areas. Talk with people outside your organization to get a better idea of how to address the issue.

Documente suas preocupações, as discussões que você teve e as soluções propostas. Isso não apenas cria um registro da sua diligência em tentar abordar os riscos de segurança, mas também pode servir como uma ferramenta de responsabilidade se as preocupações não forem atendidas e problemas de segurança ocorrerem posteriormente.

Documentar os riscos de segurança é a base para qualquer posição. Então, mesmo quando houver conversas verbais, você deve escrever no mínimo um e-mail informando os pontos discutidos na reunião. Além disso, os riscos devem estar descritos na Matriz de Riscos da empresa.

Plan B: Develop a contingency plan in case your boss continues to dismiss information security risks. This may involve seeking support from higher management, escalating the issue to the appropriate department, or considering alternative approaches to improve security independently.

Primeiro documente toda comunicação com sua liderança e depois assuma duas escolhas: 1. Aceite que as coisas são assim e nem sempre você tem poder de mudar algo 2. Busque outra empresa.

In my journey through the cybersecurity landscape, I've come to realize that not all environments will align with one's ethical standards and professional expectations. If efforts to elevate the organization's information security posture continually fall on deaf ears, it may be time to consider alternatives. Working in a place that values and leverages your expertise is crucial for both personal fulfillment and professional growth. It's about finding a balance between making an impact and ensuring that you're in an environment conducive to ethical practice and innovation.

An incident response plan should be set up to address a suspected data breach in a series of phases. Within each phase, there are specific areas of need that should be considered. The incident response phases are: Preparation Identification Containment Eradication Recovery Lessons Learned Let’s look at each phase in more depth and point out the items that you need to address

In the country I live in, most plan B will be to get insurance or outsource it. But then never observe the risk still there just from internal becoming a third party risk. Another issue is here not many of them will take company reputation very important.

Present risk in business language - e.g. in addition to CVE > 8, if you can say this vulnerability will expose us to DoS attack impacting $xxx for every 1 hour of downtime, or causing 50% of our customer unable to access that feature. This may happen within xxx days if not fixed as the exploit is being reported to be available publicly and similar attack caused *** companies to be victim last month. This quantifies the risk for business impact assessment and prioritise resources accordingly. Manager or management can understand far easily and you can highlight it properly for their attention.

Everything in a business world evolves around outcome. Every one has the right to freely choose but aren't free from consequences of their choices. The choices one present to their management or their bosses should have a winnability against threat landscape and risk appetite of their organisation presented. Many CISO lacks the approach of presenting and quantifying cyber risks independently with objectivity, while they are strong enough on their core security capabilities as the leader.

Este problema de seguridad es mas recurente en las medianas empresas, donde el activo de la información no es tenido en cuenta hasta que esta no esta mas. Desde mi experiencia siempre lo mejor es empezar de menos a mas, estableciendo métricas y objetivos a corto plazo. Lo primero es tener el control sobre los inicios de sesión de las dispositivos locales. Tener políticas de contraseñas. Políticas de BackUP recurrentes. Establecer vlans para luego dar derechos de acceso por firewalls. Y de esta manera seguir escalando y complejizando la infraestructura y las subsiguientes políticas

Lack of Security Awareness among leadership is a real concern for many businesses. (Leadership is often the worst offenders of security best practices.) Reducing risk requires resilience to be baked into the company's culture. Change—especially changing a culture—rarely happens in an organization unless it starts with leadership.

Plano A: Antes de prosseguir para a implementação do plano B, torna-se essencial comunicar a questão aos escalões superiores da organização. Frequentemente, pode ocorrer que os relatórios e atualizações não estejam sendo efetivamente entregues aos tomadores de decisão chave. Neste contexto, ultrapassar os níveis hierárquicos de forma estratégica é vital para assegurar o melhor interesse da empresa.