MARCH - 2020ENTERPRISE SECURITY| | 9background. They do not usually think in terms of risk, they do think in terms of threats. When we are asking these technical professionals to learn risk management, articulate those in the terms businesses and/or executive understand, and then drive the change, are we not asking them too much? Is it better if we hire someone from finance/economics discipline and train them on basics of cybersecurity? Educators/consultants such as Douglas Hubbard and Jack Jones have done a great job in educating practitioners on quantification of cyberrisk. However, the challenge is in the understanding of the risk itself amongst the cybersecurity practitioners. Also, there has been a lot of focused education on cybersecurity; I am suggesting we should have considerable efforts on the education on cyberrisk as well, which could be achieved through collaboration across different colleges within or outside of the same university and industry.3. Executive Education & Awareness: There has been a lot of discussion on educating the board and/or executive management about cyberrisk. There are even training and certifications provided by the National Association of Corporate Directors (NACD) in conjunction with Carnegie Mellon University (CMU) targeted to these corporate decision makers, which is great. But, in general, do we even have minimally cybersecurity and cyberrisk educated members in these decision-making bodies? We know cyber practitioners have been expected to learn the language of business. Is it fair to expect the corporate decision makers to learn at least a few words and terminologies of technology while almost everything in business is going digital? It is totally understood when a corporate decision maker does not understand how a firewall works (he/she is not expected to understand), but when the term firewall itself is too technical for him/her, it is very hard to initiate a conversation.With so much progress we have made in the cybersecurity and cyberrisk in the last few years, these are considerably easier problem to solve. But, this does not solve by itself though, this requires attention and some effort. ESMost of the cybersecurity practitioners come from a technical background. They do not usually think in terms of risk, they do think in terms of threats
< Page 8 | Page 10 >