Chapter 1 – Cybersecurity is (Not) an IT Issue – Cybersecurity For Business

CYBERSECURITY FOR BUSINESS

Chapter 1 - Cybersecurity is (Not) an IT ISSUE

summary

In short, cybersecurity needs to be understood and treated as a core business issue, much like legal and finance. No organization would make a significant business decision without consulting business and finance. In the 21st century very few business decisions ought to be made without considering their cybersecurity aspects.

There are many additional steps an organization needs to take to comprehensively address cyber risk which will be described in succeeding chapters.

Taking the right steps entails reconsidering corporate structure (as discussed in Chapter 3) and using modern cyber risk assessment tools that go beyond the traditional frameworks and checklists (as discussed in Chapter 4), as well as engaging personnel from across the enterprise in addressing a series of specific cyber issues (as discussed in Chapter 6).

Play

Organizations have made little progress in addressing cyber risk in large part because they have viewed the issue with an excessively narrow focus as just a technical/operational issue.
To compete in the modern economy, enterprises must engage in digital transformation.
Digital transformation can generate a substantial increase in growth and profitability, but can also vastly increase risk.
Foundational technical security measures are necessary, but alone are not sufficient to address cyber threats. Cybersecurity must be an enterprise-wide risk management issue.
Organizations cannot completely secure themselves, but they can manage their cyber risk with appropriate understanding, structure, investment and risk-management methods.