As part of our “C-Suite Accountability” theme, we explore why holding senior executives accountable is a necessary motivator in the prioritization, development, and adoption of cybersecurity initiatives across the small to medium-sized organization. In this post, our CTO Adam Mansour provides the best and worst questions to help leadership understand their cybersecurity prevention posture, to enable informed decisions about mitigating the risks of cyberattack. They are not technical questions, so there is no excuse not to ask them.
Let’s start with the worst questions to ask. Good intentions aside, these questions don’t generate an answer that is usable, or indicative of the true state of your security. The answers tend to take the conversation in a direction that is only relevant to a specific type of attack, a particular kind of prevention technology, or something that is too philosophical to address the real issues. In my capacity as a Virtual CISO advising businesses on their security posture, I offer leaders better questions that should yield an answer that they can understand, and that is truly representative of the state of their security.
What is our breach/incident response plan?
This question just re-affirms a false sense of security. A leader who asks this, walks away thinking “Well, good – at least we have a plan…” when in fact, chances are that your organization lacks the ability to detect that you are breached, let alone implement a plan to do something about it. It doesn’t address whether you can execute the plan, whether it has been practiced, or whether it will be effective. Despite leaders’ inclination for strategy and planning, to prevent breaches, you need practices and processes; not a plan on paper.
A better question: Can we be breached? Would you know if we were?
This question gets you right to (Read more...)
*** This is a Security Bloggers Network syndicated blog from IntelliGO MDR Blog authored by Adam Mansour. Read the original post at: https://www.intelligonetworks.com/blog/worst-best-cybersecurity-questions