Magazine menu Close Magazine menu

Author

Finbarr Toesland

Finbarr Toesland is a London-based journalist who has written for NBC News, Reuters and BBC. He has a master’s in African Studies from University of Cambridge.

Get in touch with Finbarr

Latest stories by Finbarr

ciso turnover

Keeping your CISO engaged will benefit your business. Here’s how.

  • Leadership
  • min read
    • Between stress, overwork and constant new threats, Chief Information Security Officers (CISOs) face countless challenges. And the security of nations, businesses and society relies on their doing everything they can to rise to the challenges. Growing complex threats and the rapid shift to remote work complicate an already expansive role. Today's CISO needs technical skill and the ability to respond fast to reputation-damaging breaches like ransomware attacks. High stress, low retention Many CISOs haven't been in their role long. Research by Cybersecurity Ventures in 2020 found nearly one in four (24 percent) of CISOs in US Fortune 500 companies had been in their job just a year. A further 16 percent had been in post for only two years. There's no single reason CISOs move around more than other C-suite executives, but higher stress probably plays a part. UK domain registry Nominet's 2020 CISO Stress Report found 88 percent – around nine in 10 – CISOs said they were "moderately" or "tremendously" stressed. The same report found average CISO time in post was just two years and two months. Seasoned CISO Matt White, once fashion brand Chanel's Global Head of Information Security Strategy and co-founder of software-as-a-service platform XaaS, thinks CISOs' biggest challenge is lack of understanding from companies and boards. CISOs have an uphill battle – under-resourced with budget and staff while battling red tape and bureaucracy. Relationships make a fulfilling role What can CISOs do to find a role where they feel fulfilled? White suggests considering what a potential employer wants from a CISO. Do they want change or someone to continue the status quo? Although it may be hard to assess before joining, a CISO should investigate how well the organization has established and resourced its cybersecurity. White adds, "It's paramount to understanding the type of company, its level of maturity and how supportive the board may be of changes." If the last CISO left because they didn't have the financial resources or headcount for a good cyber defense strategy, a new CISO should make sure there's since been change. Kaspersky research, in association with Longitude, a Financial Times company, found a closer relationship between the C-suite and cybersecurity teams leads to better security outcomes. Over a quarter (26 percent) of survey respondents said they believed "strong integration between the C-suite and cybersecurity teams will be very important in the next two years." This group also reported they were better prepared to deal with the impact of cyberattacks. It's important senior managers get involved in elements of cybersecurity. If CISOs foster strong relationships with C-suite colleagues, they can help those executives better understand challenges facing IT security. Continuous skill development With new threats and cyber challenges cropping up daily, CISOs must keep their skills and technical knowledge up-to-date. But their role also demands a range of 'soft skills.' "CISOs, like all C-suite roles, need continuous development, not just with technical skills," says Naveen Vasudeva, Founder and CEO of United Arab Emirates-based CyberTree Paradox, a cybersecurity firm focused on small-to-medium enterprises. "The CISO must be a diplomat, skilled in communicating technical things simply, so others can understand and take action." To thrive in their career and ensure a long tenure at companies they enjoy working for, CISOs should build their skill base. This will mean they're as prepared as possible for challenges that come their way. But if a CISO finds they're completely exhausted and can't perform their job because of lack of company support, the best option may be to seek greener pastures. Strong teams are everything C-suite executives have a vital role in improving CISO working conditions and retention. Not all C-suite members can gain a comprehensive understanding of cybersecurity. Those who do develop that understanding can show inclusive leadership and better support the CISO. A CISO is only as effective as the team they lead. Highly skilled cyber professionals are in hot demand, hard to retain in a competitive market. A Cybersecurity Ventures 2020 study found unfilled cybersecurity jobs grew 350 percent in the eight years to 2021. A CISO may enter a business and find their staff don't have the right skills, making it hard to succeed in their role. Vasudeva thinks selecting the right team is the difference between success and failure. "You can't do it all, and you shouldn't. Pick skills in your team you can rely on and help them develop their next moves, so you can develop yours. It's about leadership, not management – there's a massive difference." Short tenure hurts CISOs and companies, so everyone involved should address the issue. Kaspersky's 2020 global business survey backs this up, with 38 percent of respondents saying lack of consistent management in IT security is a challenge. Being a CISO for just a year or two isn't enough time to make a real difference or embark on transformational projects, let alone change corporate culture. There is no one way a CISO can fully protect themselves from short tenure, but if they focus on enhancing their skills, build relationships with executives and create a strong team, they will likely find themselves in a strong position. C-suite colleagues have an important role to play in retaining CISOs too – raise your cybersecurity understanding so your CISO can rely on your support.
Climate change threatens IT infrastructure disruption

How to make IT infrastructure resilient against extreme weather

  • Safer business
  • min read
    • Almost nothing in the world will be unaffected by climate change. From more storms and wildfires to rising sea levels, the impact of extreme weather events will only grow. Infrastructure, too, faces tough challenges from sudden and damaging floods, hurricanes and heatwaves. IT networks and systems, and the vital data they hold, may be most at risk. We've already seen what can happen. Wildfires can take out cell towers, preventing those affected from calling for help. Flooding has taken on a UK data center used by a mobile phone network. Businesses that plan to rely on driverless tech should be aware it's not yet working well in severe weather. For enterprises, preparing for the impacts of climate change is no substitute for doing all they can today to reduce emissions and sequester (store) carbon. But business and IT leaders can protect their vital IT infrastructure for more extreme times ahead. Why invest in infrastructure resilience? According to 2018 OECD policy paper, Climate Resilient Infrastructure, if we don't adapt infrastructure, climate change will increase extreme weather infrastructure damage in Europe ten-fold by the end of the century. Bryan Strawser, CEO of experts in crisis management and business continuity Bryghtpath, expects climate change and its associated risks will have a growing impact on IT resilience and business continuity in the coming years. "We'll see impacts from physical risks like flooding and a continued increase in extreme weather events. There will be changes in how we think about using power, water and other natural resources. It will impact large data centers and other technologies that use these resources," Strawser told me. What business leaders should consider When assessing risk from climate change, business leaders must consider a wide range of impacts. There are urgent short-term issues, like intense rainfall and cyclones, and chronic long-term problems like rising sea levels and temperature increases. But with the right partners and resilience plans, business can successfully manage the challenges climate disruption will bring. Dealing with each issue in isolation is unworkable because of the sheer number of events that could pose a threat. Strawser advises that instead, work out a comprehensive IT resilience program aligned with your business continuity plans. "It's critical your C-suite and board have good visibility of the overall resilience program. Align the program with the organization's sustainability strategy and goals to ensure unified effort across the organization," Strawser says. Raising the environmental standard of business While IT infrastructure's contribution to carbon emissions is comparatively small, there is a role for IT managers and leaders in establishing sustainability frameworks internally around things like IT procurement, choosing data centers and adopting other solutions that reduce emissions. Mike Davis, Executive Business Consultant at business and IT consultancy Waterstons, highlights the role of meeting international standards. "ICT managers should encourage and take part in organizational compliance with standards like ISO 14001, which covers practical tools to manage environmental responsibilities, and ISO 50001, for energy management." He adds, "[Companies should] consider supporting change to their organization's fundamental stakeholder value proposition by seeking B Corp membership or something similar." B Corporations are certified as meeting high standards of social and environmental performance, accountability and transparency. IT climate risk is risk on a new scale No two organizations will take the same approach to securing their IT infrastructure, as the exact climate change resilience strategies are unique to an organization's own risks. For some enterprises, data centers will need extra protection or relocating, while others may need strengthened alternative communication lines to ensure backup is available in areas prone to weather disruption. Join forces with others One company may have a limited impact on the global climate, but efforts amplify when organizations work together to build up industry capabilities and technologies. Spending time and money researching new and improved ways to construct IT infrastructure can pay dividends by reducing risk long-term. Luis Neves, CEO of Global Enabling Sustainability Initiative (GeSI,) supporting IT firms to act sustainably, believes we must encourage a new wave of research and development "centered on climate-resilient innovation, aiming to generate energy-efficient gadgets and components fit for forecasted climate circumstances and to promote ICT user and sector adaptation." Neves also thinks, "This could spur new learning processes inside the industry and help it adapt to climate change by increasing flexibility and diversity." Getting fast responses right For businesses that don't set up a clear and comprehensive strategy to address IT resilience issues, unforeseen weather episodes can cause far more damage than for those who create a plan when climate change-driven events strike. Neves says Deutsche Telekom shows how an organization should respond to devastating damage to IT infrastructure. Extensive flooding in Germany in July 2021 destroyed or damaged much IT infrastructure, with around 250,000 people losing mobile network connection. Deutsche Telekom immediately set up a fast reaction team and four-phase plan. First, they created a single point of truth for customer help, then tackled technical and network disaster recovery. Finally, they set up a company-wide emergency team. With catastrophic weather events growing in frequency, business must adapt to a new normal where damage to IT infrastructure is common. Through comprehensive planning, they can be more competitive and ensure the availability of life-saving communication lines. "These effects are already felt and will only worsen," says Neves of GeSI. "Long-term plans that address national priorities for sustainable development and progress toward international commitments will be crucial."
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries