More than ever, CEOs and other corporate executives are keeping a close watch on the risks posed by digital threats and cyberattacks.
According to PwC's Annual Global CEO Survey (PDF) released earlier this year, 61 percent of respondents said they are "somewhat" or "extremely" concerned about cyber threats - a rise of 13 percent from 2014. In the United States alone, 86 percent of CEOs felt this way. The survey also concluded that three-quarters of CEOs in America view cybersecurity as strategically "very important" to their organization. Our 2015 Security Pressures Report backs this up, with 61 percent of more than 1,000 security professional respondents feeling the most "people pressure" coming from their owners, boards and C-level executives.
Yet despite this growing awareness, there remains a noticeable chasm between the security obligations of the board room versus the server room.
If you run a business, you are familiar with the frequency by which data breaches have occurred and how crushing they can be to an organization's fiscal health - from reputational harm to compliance fallout to customer attrition. But you may not be fully versed in what role you play in ensuring the message of security is prioritized across your company.
To help you implement strong corporate governance around data protection - and ensure your infosec team feels the corner-office love - we've compiled a list of the five essential habits of a security-conscious CEO:
1. You unite: The risk posed by cyber is no different than any other risk facing a business, and it's much bigger than just an IT issue. CEOs who care about security and risk management endorse a certain culture by championing communication and collaboration from the top down - and even vertically across partners. But you also recognize the need for security education from the bottom up, considering many of today's most devastating security breaches are perpetrated by first tricking employees into clicking on something they shouldn't, thus inviting in malware. (Of course, you yourself can be a phishing target too).
2. You see the bigger picture: Similar to the first point, security now transcends any one person or department within an organization. A security shortfall or lack of preparedness in one area of the business could send the company into a nosedive if it is trying to prevent or respond to a compromise. Security buy-in must come from everyone, and you're the person who can best make that happen.
3. You are realistic: As demanding as chief executives must be around ingraining security into the company culture, you also must be empathetic to the cause. Guaranteed security is not achievable, and even the most mature organizations still experience incidents. With businesses having to be right 100 percent of the time, dedicated attackers will find a way to get in. As CEO, you should not expect perfection, but instead rally around your IT and security staff, and inspire the company to place itself in the best possible position to avoid a costly breach.
4. You are visionary: The most effective CEO won't sit idly by and solely rely on a quarterly visit from the security group. Instead you regularly consume news and are in constant contact with security leaders. That means you have the pulse on the latest threats and grasp that cybersecurity is a business risk - not just a point-in-time compliance exercise. It's also about detection, prevention - and response, in light of the increasing likelihood a breach does occur.
5. You recognize the value of outside help: While the PwC survey pointed to a significantly rising understanding of cyber risk, it also found that 73 percent of CEOs globally - and 78 percent in the United states - are concerned about having adequate skills on hand to meet their key threats. With cyber being one of those, forward-thinking CEOs will turn to trusted partners, such as managed security service providers, to help amplify protection in areas where the on-premises know-how is lacking.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.
