Every good chief information security officer (CISO) knows that a potentially existential cyber attack, whether from an external or internal source, looms ahead.
There is no “if” for the CISO. Rather, “who, what, where, when, and how” dominate the thought process.
The good CISOs know the punch is coming. The great CISOs anticipate the punches and take proactive measures to avoid, deflect, and/or minimise any punches thrown their way.
In this section, I will share some due care and due diligence actions CISOs and their organisations should accomplish to prepare to survive a potentially “existential cyber punch”.
The first step a CISO should take is to understand their key cyber terrain. CISOs need to understand their organisation’s strategy, mission, goals and objectives.
They should know their organisation’s processes and information, their value, and the impact on their organisation’s operations.
The [US National Institute of Standards and Technology] national cyber security framework summarises these activities under its “identify” category.
Proportionate defences
Frederick the Great supposedly said, “he who defends everything, defends…
