Welcome!

Linux Containers Authors: Yeshim Deniz, Liz McMillan, Elizabeth White, Pat Romanski, Jyoti Bansal

Related Topics: Cloud Security, Java IoT, Microservices Expo, Linux Containers, @CloudExpo, SDN Journal

Cloud Security: Article

Selling Security

Enterprises can no longer afford to see their CISOs confined to the dark recesses of the IT department

The threats facing network operators all over the world, spanning service providers, enterprises, cloud and hosting providers and mobile operators alike, are by no means stalling. While optimism is always the name of the game, we know all too well in security that trying to keep pace with the slew of attack vectors out there today is an unfortunate reality. As our 9th annual Worldwide Infrastructure Security Report reveals the magnitude of attacks is on the upswing once again and coupled with increasingly complex, multi-vector style attacks, the threat is all too real.

Winning the battle against those threats depends on many factors: the expertise of the security organization; response plans and resources; and the ability to put those plans into action. Increasingly, part of the challenge for Chief Information Security Officers (CISOs) is in getting the right support from their senior management. That's not necessarily a new hurdle for CISOs to overcome. Management buy-in has always been vital for dealing with IT security threats. But with threats becoming more complex, the priority for CISOs is ensuring that they have sufficient resources to deal effectively with those issues.

Executive and board-level awareness of these threats is already pronounced: recent research found that senior executives and risk managers within American and Canadian enterprises today are more concerned about losing money through cyber threats than they are through property damage or investments or securities failing.[1] This growing board-level awareness as to the severity of IT-based attacks means CISOs have an opportunity to champion their own role as a risk manager and defender of the business. By showing leadership and engaging proactively with other heads of department, CISOs can show how their expertise adds a ‘return on prevention' value to the business.

However, when it comes to getting their voices heard, many CISOs face an uphill struggle from day one - everything from IT being seen as ‘just' the cost of doing business and not an asset, to board members with vastly different priorities (i.e., those who would rather wait for their house to be on fire to call the fire department versus taking preemptive action upfront). If CISOs are to deliver an understandable call to action and gain the credibility to push their strategic plans, they need to deploy a range of tactics to make their voices heard including:

  • Discuss security risks in a way that resonates with management: Expecting the management/executive team or board to learn the information security professional's vocabulary can be unrealistic. Instead, the CISO must communicate threats in a way that the leadership team understands. This language barrier doesn't need to be a hindrance though; approached in the right way, it can actually be an excellent way for CISOs to showcase how their role fits within the overall corporate risk management strategy.
  • Translate prevented costs to realized goals: The substantial increase in botnet code modification and botnet node recruitment may be crucial in the understanding of how attacks are developing, but bring these terms up in a conversation with a CFO and you're likely to see their eyes glaze over faster than you can say Distributed Denial of Service (DDoS). The primary message a CISO needs to get across is the threat that attacks of any kind pose in terms of lost revenue, reduced productivity and damage to the business brand.
  • Anchor the threat in your own organization: Engage with the CFO and COO to obtain financial figures relating to the cost of your operations and the amount of money generated through online services and a workforce reliant on a fully functioning IT network. Armed with these figures, CISOs can offer a realistic estimate of the negative financial impact of a level-one cyber attack where key IT services might be adversely affected. In an age where many institutions have built strong revenue streams and enhanced customer loyalty through online and mobile services, it also provides an opportunity for CISOs to demonstrate the crucial role they can play in preserving business operations.

These days, no enterprise risk assessment and business plan is complete without taking into account the operational risk represented by cyber security attacks intended to have a negative effect on the availability of key online services. Enterprises can no longer afford to see their CISOs confined to the dark recesses of the IT department because as DDoS attacks and other cyber threats have become increasingly high-tech and more complex, enterprises need a technologist with a seat at the table.

But with greater responsibility comes the challenge of gaining and maintaining credibility within the C-suite. And it is only by conveying this threat in a language the business understands - by demonstrating the potential outcomes using examples familiar to other business heads - that the CISO will be able to get the buy-in they need to do their job properly. This is the challenge and the opportunity - the opportunity for the CISO to get the recognition they deserve and the backing to deal with the ever-growing threat faced by organizations today.

Resource:

  1. Execs Say Cyber-Attacks a Top Threat: AIG Survey-CNBC News-6 February 2013

More Stories By Rakesh Shah

Rakesh Shah is Director, Product and Strategy Marketing of Arbor Networks. He has been with the company since 2001, helping to take Arbor's products from early stage to category-leading solutions. Before moving into the technical marketing team, Rakesh was the Director of Product Management for Arbor's Peakflow products, and he was also a manager in the engineering group. Previously, Rakesh held various engineering and technical roles at Lucent Technologies and CGI/AMS. He holds a M.Eng. from Cornell University and a BS from University of Illinois at Urbana-Champaign both in Electrical and Computer Engineering.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
SYS-CON Events announced today that delaPlex will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. delaPlex pioneered Software Development as a Service (SDaaS), which provides scalable resources to build, test, and deploy software. It’s a fast and more reliable way to develop a new product or expand your in-house team.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend @CloudExpo | @ThingsExpo, June 6-8, 2017, at the Javits Center in New York City, NY and October 31 - November 2, 2017, Santa Clara Convention Center, CA. Learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
SYS-CON Events announced today that DivvyCloud will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. DivvyCloud software enables organizations to achieve their cloud computing goals by simplifying and automating security, compliance and cost optimization of public and private cloud infrastructure. Using DivvyCloud, customers can leverage programmatic Bots to identify and remediate common cloud problems in rea...
SYS-CON Events announced today that Tintri, Inc, a leading provider of enterprise cloud infrastructure, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Tintri offers an enterprise cloud platform built with public cloud-like web services and RESTful APIs. Organizations use Tintri all-flash storage with scale-out and automation as a foundation for their own clouds – to build agile development environments...
SYS-CON Events announced today that Carbonite will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Carbonite protects your entire IT footprint with the right level of protection for each workload, ensuring lower costs and dependable solutions with DoubleTake and Evault.
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
SYS-CON Events announced today that Tappest will exhibit MooseFS at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. MooseFS is a breakthrough concept in the storage industry. It allows you to secure stored data with either duplication or erasure coding using any server. The newest – 4.0 version of the software enables users to maintain the redundancy level with even 50% less hard drive space required. The software func...
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
SYS-CON Events announced today that EARP will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. "We are a software house, so we perfectly understand challenges that other software houses face in their projects. We can augment a team, that will work with the same standards and processes as our partners' internal teams. Our teams will deliver the same quality within the required time and budget just as our partn...
DevOps at Cloud Expo – being held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real r...
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
Most technology leaders, contemporary and from the hardware era, are reshaping their businesses to do software in the hope of capturing value in IoT. Although IoT is relatively new in the market, it has already gone through many promotional terms such as IoE, IoX, SDX, Edge/Fog, Mist Compute, etc. Ultimately, irrespective of the name, it is about deriving value from independent software assets participating in an ecosystem as one comprehensive solution.
SYS-CON Events announced today that A&I Solutions has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 1999, A&I Solutions is a leading information technology (IT) software and services provider focusing on best-in-class enterprise solutions. By partnering with industry leaders in technology, A&I assures customers high performance levels across all IT environments including: mai...
Every successful software product evolves from an idea to an enterprise system. Notably, the same way is passed by the product owner's company. In his session at 20th Cloud Expo, Oleg Lola, CEO of MobiDev, will provide a generalized overview of the evolution of a software product, the product owner, the needs that arise at various stages of this process, and the value brought by a software development partner to the product owner as a response to these needs.
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
Five years ago development was seen as a dead-end career, now it’s anything but – with an explosion in mobile and IoT initiatives increasing the demand for skilled engineers. But apart from having a ready supply of great coders, what constitutes true ‘DevOps Royalty’? It’ll be the ability to craft resilient architectures, supportability, security everywhere across the software lifecycle. In his keynote at @DevOpsSummit at 20th Cloud Expo, Jeffrey Scheaffer, GM and SVP, Continuous Delivery Busine...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs ofte...
SYS-CON Events announced today that Outscale will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Outscale's technology makes an automated and adaptable Cloud available to businesses, supporting them in the most complex IT projects while controlling their operational aspects. You boost your IT infrastructure's reactivity, with request responses that only take a few seconds.