Boardroom Conversations on Security: Part 4

By

Boardroom Conversations on Security is an ongoing series on how to discuss and present cyber security concerns to your board. It comes from an extended conversation between Enrique Salem, Investor at Bain Capital, and Erkang Zheng, CEO of JupiterOne. For your convenience, the entire series is available as a single download.

"Enrique, when preparing for a board meeting, what are the things the board would like to hear from the CEO? Are there specific metrics or measurements you look for?"

Enrique Salem

The first place I would start with is to give a view of, "Where are we from a security risk perspective?" I look at it in two dimensions, starting with our own security maturity. Give me a point of view of are we just building a security program; Have we developed it? Is it something that's repeatable? How do we think about our security program and the maturity of the security program?

To me, what I would want to them to show me is, "Here are the functions we have, the roles of people in security, and here are the processes that we use." I'd want to see that. That's not a metric, that's more of a discussion.

Erkang Zheng

Sometimes that can be challenging. It depends on the company and the actual security team's maturity. An immature security team can come to you and say, "We have a mature security program," without knowing what they don't know. It goes back to your point that this is not a metric, but a discussion. Otherwise, if you're just asking to see a chart of security maturity based on the red, yellow, green type of thing, it doesn't really uncovered the actual details of the maturity itself.

Enrique Salem

I look at it from the capability maturity.  As an example, look at the work that was done on the old Carnegie Mellon Capability Maturity Model. There's lots of frameworks you can use to try and articulate the maturity of an organization. I'd want to have that discussion.

The other thing I would want to do is talk about a set of areas that really matter, that need to be reported on around compliance issues, specific regulatory compliance issues. I would like you to show me and have a way of communicating to me that if we're taking credit card data, are we PCI compliant? If you're in a healthcare business, are we HIPAA compliant?

I want to make sure there is a way to understand there are regulations that govern our business, and here's why I believe we are compliant with those regulations. Then there's a set of certifications that we care about. For example, a lot of my companies are cloud-based, so where are you on things like SOC 2 and other certifications that we need to have to be able to be in business. There's some very specific things that you should just be able to go through and show the board clearly that you're doing and have done and have taken good care of.

Erkang Zheng

I would go a step further beyond what you said about compliance, Enrique. A lot of times the board asks, "Do we have SOC 2? Do we have HIPAA? Do we have PCI?" I would challenge the team to think about, "Do we have this continuously." It is not just, "Yes, the auditor gave me this report and stamped it yesterday."

What the board needs to ask and what the executive team and the CISO team needs to be able to present is, "At any given time, if the auditor walks in the door today, I can show you the same compliance status within moment's notice."

Continue reading with Boardroom Conversations on Security: Part 5, or download the entire series for easy distribution to your board and security team. 

Read the full Boardroom Conversations series:

About Enrique Salem

Enrique Salem - 300 x 300

Enrique Salem was the president and CEO of software company Symantec from 2009 until 2012, and was a member of Barack Obama's U.S. President's Management Advisory Board.  Enrique joined Bain Capital Ventures in 2014, where he focuses on infrastructure software and services with a specialization in cybersecurity.

 

About Erkang Zheng

Erkang Zhang

Erkang Zheng is a hands-on leader in cybersecurity. He is an engineer by trade and an entrepreneur at heart. Before starting JupiterOne, Erkang was CISO, Privacy Officer, at GM LifeOmic Security. In August of 2021, Erkang was selected as one of The Top 25 Cybersecurity CEOs of 2021 by The Software Report

 

Mark Miller
Mark Miller

Mark Miller speaks and writes extensively on DevSecOps and Cybersecurity. He has published 9 books, including "Modern Cybersecurity: Tales from the Near-Distant Future"

Keep Reading

What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)
February 6, 2023
Blog
What’s new in JupiterOne: Reducing time to value with the new Query Builder (Part 2)

The new JupiterOne Query Builder streamlines your querying experience by eliminating errors, simplifying query builds, and reducing time to value.

The top 10 questions that every engineering leader should be able to answer
February 2, 2023
Blog
The top 10 questions that every engineering leader should be able to answer

We polled some of our engineering leaders to see what it takes to succeed. In part two, we see if their answers align with the CISOs we talked to.

Identify compromised versions of Github using JupiterOne
January 31, 2023
Blog
Identify compromised versions of GitHub apps using JupiterOne

As a preventative measure, Github will be deprecating the Mac and Windows signing certificates used to sign Desktop app versions 3.0.2-3.1.2 and Atom versions 1.63.0-

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.

15 Mar 2022
Blog
One line headline, one line headline

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud eiut.