Realogy

The days of information security and data privacy budgets expanding year-over-year have started to slow significantly. This, coinciding with the increased velocity of data privacy legislation and expansion of the use of artificial intelligence (AI), presents significant concerns for information security and data privacy groups. The average information security/ data privacy budget is close to 10 percent of the overall IT budget, but what we are seeing is spending at the 2020 limits and not growing as you would expect. According to a study conducted by the Ponemon Institute, it was found that ‘83 percent of directors describe themselves as at least ‘moderately’ engaged with overseeing the risk of cyber attacks.’ This is very significant and does not align with the data on slowing security budgets. What is the disconnect? We can see several trends and potential reasons, but the feeling seems to get the most out of what you have and avoid the new ‘shiny’ toys. So, if 83 percent of the BoD cares about cybersecurity, and the SEC requires specific cybersecurity representation on the BoD, how do information security/data privacy groups manage this along with preparing for the explosion of data sets resulting from AI data models?

This predicament requires IT professionals to take a much more business approach to safeguard assets/data and make decisions on a risk-based approach. This is not a new concept, but this is now a narrative that will resonate with senior management and the BoD and be the proverbial good story to tell. In talking with colleagues in different size companies and industries, we should bucket controls into five (5) categories and budgets based on criticality:

• Crown Jewels (30 percent)

• Technical (30 percent)

• Regulatory (20 percent)

• Artificial Intelligence (10 percent)

• Administrative (10 percent)

The percentages are just an example, but they would likely be close after your initial analysis. When I say crown jewels, it may overlap the other areas, but knowing what drives the company's revenue and what is critical to the organization should be a priority. The CISO function is as much a technical expert as a business leader in our current data-centric world. This requires the CISO and information security group to be a partner and not in the Yes or No business.

The technical controls can be adjusted based on the risk of the assets and data, along with the culture of your organization. The culture is important because a company that is not acclimated to strict controls can create user experience issues and can thwart the overall mission. This is where a leader needs to forge those partnerships, get management buy-in, understand the data, and implement accordingly. When we think of risk/cost and technical controls, the following items can provide robust security and not require substantial cost:

• Monitoring/SIEM tool

• Encryption in-transit

• Malicious Activity blocking, not just detention (there is a big difference)

• Incident Management Tool

• API Security

In our new world of seamless data provisioning, these items can provide appropriate data safeguards and not disrupt the business processes that drive profits, innovation, and required data sharing. As always, there is no perfect answer or solution, but this provides a trusted approach and focuses on proven technology.

"It is important to position AI in your organization as not a panacea, but a collection of systems and algorithmic processes to maximize your data position."

The regulatory and compliance side can be a difficult path to maneuver and is fraught with pitfalls and paradigm shifts in the legislative landscape. Every CISO has it ingrained in them that they need to meet all compliance guidelines, or the world will end. This is not the case, but being adept at what is needed is critical. To meet this need, the following items need to be in place to meet a broad spectrum of domestic/global compliance requirements:

• Data/Asset Inventory

• Ability to respond to data subject access requests (DSAR)

• Data Retention

• Cookie Consent/Global Privacy Controls

• Partnership w/Legal and Internal Audit

How do organizations handle the explosion of AI? It is important to position AI in your organization as not a panacea but a collection of systems and algorithmic processes to maximize your data position. It will take a village to develop valuable models and oversight to ensure proper governance. When building out your respective AI infrastructure, incorporate the following principles into your strategy:

• Build responsible AI development (RAID) into your models. Removing bias is critical.

• Start with initial models and test on a small scale, low risk, and fail fast.

• Avoid using open AI models. This exposes your data, and trusted results may be problematic.

• Safeguard the models and build in proper data governance.

The Administrative side of the house is the least visible but pays dividends for the entire user base. This is focused on the user training, learning, and communications portion of the program. This requirement spans all areas and makes sure the employees/contractors are well-versed and understand how to safeguard data and be risk-averse when applicable. Another component is communicating initiatives to the user base and explaining/ensuring awareness and buy-in.