Boardroom Conversations on Security: Part 3

By

Boardroom Conversations on Security is an ongoing series on how to discuss and present cyber security concerns to your board. It comes from an extended conversation between Enrique Salem, Investor at Bain Capital, and Erkang Zheng, CEO of JupiterOne. For your convenience, the entire series is available as a single download.

"Enrique, how do you avoid the CEO or other executives becoming uncomfortable with the CISO approaching the board?"

Enrique Salem

First of all, the board is probably going to seek out the CISO. What I tend to do given the kind of role I usually play on most of the public boards is to make sure everybody knows I'm going to talk to the CISO directly one-on-one outside of the board. I want to have that relationship. Most of my CEOs, once I talk to them about it, respond with "Of course, please do."

The key is your goal. When a CISO talks to the board, what he/she can say to them is, "I'm trying to raise security awareness. My goal is to raise the awareness of the board and the company around their role in security." When talking to the board, try to help them understand what they can do to support all of us in making the security profile of the company better. 

Unfortunately, some people are going to be a bit insecure. You can't let that deter you from getting the help you need. What I don't want to happen is that that communication isn't there, and then something happens and the board asks, "Why didn't you tell me? Why didn't you talk to me? Why didn't you talk to us about this concern you had?" That's a situation you never want to be in. 

The board is always going to ask you, "When did you suspect...". If an incident does happen, they are going to say, "When did you start worrying about this? What was the first time you felt like there was an issue?" You never want to be on your back foot. It's not anything other than just being transparent. Boards want to know. They want to know the things they can spend some time thinking about where they can be helpful. 

I go to many discussions in not just security, but across all the functions. I'm on three Fortune 500 boards, probably six or seven public companies, and then probably another dozen private companies. In the discussions, the board wants to hear what's going on and not some sugar-coated version. It doesn't mean they want to hear a bunch of complaining. What they want to hear is just transparency, authentic, intellectually, honest discussion about what's going on. I encourage not only just security, but all functions to take the approach of letting the board know what is going on.

Erkang Zheng

With all of the things happening in cybersecurity, my sense is that the level of understanding at the board level has been maturing as well. Years ago, if you went to the board, presenting a scenario and an exercise that was just completed, talking about all of the things that could fall apart, you would risk presenting a stark and dark picture that scared the board.

Nowadays it's different. The board has a level of understanding that security is not about being perfect, it is not about covering everything. It is about seeing and understanding where the risk is and picking the right battles and the right priorities to reduce that.

Enrique Salem

The board wants you to succeed, we're all on the same team! It's not an adversarial relationship. More than anything else, the board has a responsibility to shareholders, they want the company to be successful. They want the people in the company to be successful, and they want to help. The best teams engage the board in a constructive dialogue about what's working, what's not working, what we can collectively do to improve the company. 

The objective is not to show them how smart you are. That's not really the goal here. It's about them having confidence that you're on top of the right issues, that you're focused on the things that matter, that they can expect you to be transparent. That's what we're all looking for. It's not an adversarial relationship, it's a collaborative, let's win together relationship.

Continue reading with Boardroom Conversations on Security: Part 4, or download the entire series for easy distribution to your board and security team. 

Read the full Boardroom Conversations series:

About Enrique Salem

Enrique Salem - 300 x 300

Enrique Salem was the president and CEO of software company Symantec from 2009 until 2012, and was a member of Barack Obama's U.S. President's Management Advisory Board.  Enrique joined Bain Capital Ventures in 2014, where he focuses on infrastructure software and services with a specialization in cybersecurity.

 

About Erkang Zheng

Erkang Zhang

Erkang Zheng is a hands-on leader in cybersecurity. He is an engineer by trade and an entrepreneur at heart. Before starting JupiterOne, Erkang was CISO, Privacy Officer, at GM LifeOmic Security. In August of 2021, Erkang was selected as one of The Top 25 Cybersecurity CEOs of 2021 by The Software Report

 

Mark Miller
Mark Miller

Mark Miller speaks and writes extensively on DevSecOps and Cybersecurity. He has published 9 books, including "Modern Cybersecurity: Tales from the Near-Distant Future"

Keep Reading

What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)
February 6, 2023
Blog
What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)

The new JupiterOne Query Builder streamlines your querying experience by eliminating errors, simplifying query builds, and reducing time to value.

The top 10 questions that every engineering leader should be able to answer
February 2, 2023
Blog
The top 10 questions that every engineering leader should be able to answer

We polled some of our engineering leaders to see what it takes to succeed. In part two, we see if their answers align with the CISOs we talked to.

Identify compromised versions of Github using JupiterOne
January 31, 2023
Blog
Identify compromised versions of GitHub apps using JupiterOne

As a preventative measure, Github will be deprecating the Mac and Windows signing certificates used to sign Desktop app versions 3.0.2-3.1.2 and Atom versions 1.63.0-

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.