Governance

Cyber security governance gives an organisation a strategic look at how it controls its security, such as by defining its risk appetite, building accountability frameworks, and figuring out who is in charge of making decisions. The ISO/IEC 27001 standard says the following about how cybersecurity is managed.

The system that an organisation uses to direct and control security governance. It sets out the accountability framework and keeps an eye on things to make sure that risks are being dealt with properly. Management makes sure that controls are put in place to deal with risks.

In the past, cybersecurity has been seen as a technical or operational problem that needs to be solved in the technology space. Planning for cybersecurity needs to move out of the back office and into its own area that is in line with the law, privacy, and enterprise risk. The CIO, COO, CFO, and CEO should all be at the table with the CISO. This helps to understand that cybersecurity is not just a technology issue, but also a risk management issue for the whole company, as well as a legal issue.

Setting the right tone for the organisation is the most important part of any programme for good governance. Setting the right tone at the top is not just a matter of following the rules. It makes sure that everyone is working as a team and following the plan to complete business tasks, BYOD risk mitigation and protect assets as part of a risk management programme and security strategy.

In the past, cybersecurity was taken care of by putting in place a solution to fix a problem or reduce risk. Many cybersecurity departments have technical security measures like firewalls or intrusion detection, but they often lack basic policies, best practices, and processes for cybersecurity governance. Where policies or processes do exist, they are often out of date or not followed.

Many cybersecurity departments also have training programmes that aren’t good or aren’t enough, and they don’t cover all levels of an organisation. Recent hacks have shown that many organisations don’t have good enough programmes for hardening and patching. Bad access control practices are also a problem. These include uncontrolled group passwords, shared accounts, a lot of admin privileges, shared root access, and no authorisation process except at a low operational level.