Chief Information Security Officer Research Articles

A Simulation-based Education Platform for Security Investments Through Culture and Knowledge Convergence

Cybersecurity is one of the most critical sectors of information systems and is considered a strategic priority for many Organizations. Information security investments are a crucial aspect of cybersecurity. However, it often happens that the economic decisions, which aim to improve information security, have poor efficiency. One reason is the lack of background on economics of the Chief Information Security Officers who are often not familiar with the evaluation of the non-technical aspects of security, e.g. economics. The other reason is the cultural gap between the different persons related to business management and administration. In this paper we present an interactive - simulation software designed to familiarize the aforementioned persons with information security investments. The software is actually a game that aims to boost learning for all the stakeholders who are involved in the investment process. Α better understanding of the processes, the technical, economic and human factors, along with the cultural convergence of the stakeholders will help boost the efficiency of investments. Design Science is used as the research method. The creative method, a brainstorming technique, is combined with the five steps of Design Science, i.e. explicate the problem, define the requirements, design and develop the artefact, demonstrate the artefact, and evaluate the artefact, to develop a process framework that will be able to cope with this problem. The artefact is an interactive-simulation platform in which a person could take the decision maker role and (a) deal with events that happen and (b) investigate different aspects of information security investment complexity. The evaluation of the artefact is made with a case study in the Industry, where real world data are used to feed the simulation and real-world decision makers play the game in order to better understand the different aspects of the problem and help us trim and enhance the functioning of the platform. Finally, limitations are elaborated and future work is also discussed.

Improving cyber risk governance through storytelling

This paper addresses the critical challenge of cyber risk governance faced by executives, security committees and boards of directors in the rapidly changing digital landscape. Cyber security complexity, characterised by data deluges and the translational gap between technical jargon and business risk, significantly hinders effective cyber risk messaging and governance. Drawing on five years of research and interviews with chief information security officers (CISOs), the paper highlights the struggle in establishing trust and confidence in governance bodies due to these complexities. It introduces three constructs that aim to simplify cyber security messaging to enhance cyber risk governance: the intelligence to risk (I2R) pyramid, five risk impacts, and resilience and proximity graph. Each construct, illustrated with practical examples, is designed to provide clarity and foster understanding between cyber security professionals and governance bodies, ensuring a cohesive approach to cyber risk management. Readers can expect to gain valuable insights into overcoming the limitations of traditional risk communication tools such as risk registers. By adopting the presented storytelling approach, the paper promises strategies for building trust through transparency and accountability, bridging the communication gap between technical and executive levels, and facilitating informed decision making for improved governance outcomes in the face of cyber security threats.

A Qualitative Multi-Method Study of U.S. Banks’ Financial Reporting Addressing Security Risk Management (SRM) Operational Effectiveness and SRM Maturity

Security risk management (SRM) presents continued challenges for IT executives. Because of growing data breaches, significant funding needs, and non-stop malicious cyber threats, SRM operational effectiveness and SRM maturity present ever-changing complexities. In organizations, cyber-related events, including advancing information technologies, contribute to the increasing complexity and guarded nature of SRM. This qualitative study was designed to examine SRM operational effectiveness and SRM maturity in financial reporting. Using a set of qualitative techniques, a sample of 107 SRM financial reported statements were rendered from 1,113 U.S. banks’ financial reporting artifacts. Validation of results involved interviews and Q-sorting among three Chief Information Security Officers (CISOs) as subject matter experts. This study presented evidence of varying perceptions of SRM operational effectiveness and SRM maturity were conveyed that may or may not properly reflect how well organizations may perform against cyber-related events. To researchers, practitioners, and policymakers, this study offers an alternative approach and theoretical considerations for future SRM research, especially when reporting cyber-related events.

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

Chief Information Security Officer: A Vital Component of Organizational Information Security Management

An overview of cybersecurity in Zimbabwe's financial services sector.

As nations, businesses, and individuals rely on the Internet for everyday use, so are cybercriminals manipulating systems to access information illegally and disrupting services for financial gain. The global cost of cybercrime eclipsed one trillion US Dollars in 2020, with Africa losing US $3.5 billion. A quantitative research methodology was adopted to investigate factors affecting cybercrime in Zimbabwean financial institutions. The study focused on the technical aspects of cybersecurity. Data were collected from July 2022 to October 2022, targeting technology experts in the financial services sector. Participants were recruited from 13 institutions to rank cybersecurity constructs, frameworks, and challenges associated with cybersecurity. Data was collected using a questionnaire distributed to participants. Descriptive statistics were used to extract meanings from the responses that measure mean and standard deviation. Network and data security were the most highly ranked cybersecurity constructs, while physical security was the least. The top three barriers are increasing sophistication of threats, limited skills and emerging technologies, while lack of executive support was the least. The top frameworks used are the Information Technology Infrastructure Library (ITIL) and Control Objectives for Information and Related Technologies (COBIT), while a fifth is yet to adopt cybercrime frameworks. The study proposes that financial institutions establish a cybersecurity culture to fight cybercrime, addressing cybersecurity barriers and following best practices. Financial institutions should invest in cybersecurity technologies, train security specialists, and employ a Chief Information Security Officer (CISO). The study's small sample may affect the generalisability of the results. Financial institutions should implement strategies to raise awareness and collaborate with institutions to train cybersecurity security specialists to close the skills gap.

정보보호최고책임자의 겸직과 정보보호 성과: 정보보호 공시 데이터를 중심으로

정보보호최고책임자의 겸직과 정보보호 성과: 정보보호 공시 데이터를 중심으로

There’s a Strong Wind a’Blowing re Security Disclosures: Lessons Learned from SolarWinds — An analysis of the significance of the SolarWinds case for companies with making security statements on websites and in public filings

Abstract For years now, we have been advising clients to be cautious about including overly broad, or overly detailed, statements in their online privacy policies, noting that the FTC has in the past interpreted such statements as being representations to the market - such that false or misleading statements made therein could constitute misrepresentations. The Securities Exchange Commission complaint last year filed against SolarWinds Corp. and Timothy G. Brown (between July 2017 and December 2020, the Vice President of Security and Architecture and head of the Information Security group, and as of January 2021, the Chief Information Security Officer, for SolarWinds Corp.) has now made it clear that the same risk applies to public statements regarding the state of security of an organization. The SEC complaint raises additional related issues, however: namely, to what extent are organizations required to detail instances of non-compliance with their security policies in their public security disclosures; and to what extent should software companies be held to a higher standard of cybersecurity disclosure. This article proves the background to the SEC complaint (I.); provides a overview of the SEC complaint’s critique of the online security statement published by SolarWinds, and the security disclosures in the securities filings of SolarWinds (II.); outlines the challenges posed by the SEC approach in the SEC complaint and the resulting blowback, in particular from chief information security officers (III.); highlights three key lessons learned from the SEC complaint (IV.); and concludes (V.) with a warning as to what this means for organizations publishing online security statements.

GDPR and the indefinable effectiveness of privacy regulators: Can performance assessment be improved?

Abstract Data protection regulations like the General Data Protection Regulation (GDPR) are increasingly important in securing individuals’ privacy as society goes digital. The success of any regulation, however good, ultimately depends on how well it is executed. Existing literature fails to answer what good execution means in this context. We research what practitioners think are the objectives of data protection regulators and how they evaluate their effectiveness. We explore novel ways to assess regulator performance more systematically. We surveyed 70 chief information security officers and conducted 23 structured interviews. The interviewees included informed business executives, lawyers, digital rights activists, and four national regulators. We supplement it with an analysis of diverse enforcement databases. Our findings indicate a mismatch between the broad presumed objectives attributed to regulators and the narrow criteria used to judge them in practice. Perception of the regulator’s effectiveness is subjective, sanctions-focused, and influenced by one’s role and responsibilities. Moreover, the independence of regulators, intentionally designed to insulate them from daily politics, raises serious questions of accountability. We examine the historical, cultural, and organizational motivations behind the current byzantine complexity of the GDPR regime. Lastly, we contribute a series of key performance indicators and make structural suggestions around centralized and standardized reporting of cases to deliver improved learning, legitimacy, transparency, and comparability. We believe our findings have important implications for the future development of regulator assessment and accountability in Europe and in the growing number of GDPR-like regimes outside Europe.

Is the Chief Information Security Officer an Orchestra Conductor or a Concertmaster? Qualitative research from France

As companies become increasingly global and Internet based, information security has become a critical issue for organizations. To face these new threats, the position of Chief Information Security Officer (CISO) has emerged in many companies. We aim to study this new career and determine its current scope of actions and seek to investigate this new profession in terms of roles, tasks and competencies. This study relies on a qualitative questioning methodology, with structured face-to-face interviews in France. Despite many contributions on security risk management, there is limited research on the CISO profession. The CISO needs many skills, competencies, and carries out a range of tasks.

A framework for cyber-risk insurance against ransomware: A mixed-method approach

Hackers follow a standard cyber kill chain process and install ransomware payloads using phishing emails on firms belonging to critical industry, resulting in huge losses in revenue, reputation, and customer churn. This study uses a mixed-method explanatory approach to mitigate ransomware attacks. We present the quantitative Ransomware Risk Management Model (R2M2) based on protection motivation theory (PMT). The Ransomware Risk Assessment module based on the threat appraisal component of PMT and the National Institute of Standards and Technology (NIST) guidelines can help the chief information security officer (CISO) to assess the risk using predictive analytics techniques. The Ransomware Risk Quantification module uses collective risk modeling to compute the severity of a ransomware attack on an organization. The Ransomware Risk Mitigation module helps the CISO to minimize the probability and impact of a ransomware attack on their organization by (i) investing in perimeter security technologies and training to ensure prepare, deter, detect, restrain, recover, and review mitigation strategies, (ii) adopting the National Institue of Standards and Technology (NIST) Cybersecurity Framework to ensure business resilience, and (iii) mitigating the residual risk by investing in cyber-risk insurance. We validated the proposed method using a qualitative study by interviewing participants form firms affected by ransomware, managed security service providers, security consultants, and cyber-risk insurers.

Visualizing Cybersecurity Coverage using MITRE ATT&CK Framework

This paper presents an innovative approach to visualizing cybersecurity coverage within the Zscaler Risk360 product, leveraging the MITRE ATT&CK framework. Emphasizing a user-centered design methodology, the study integrates the complex ATT&CK framework into a practical, interactive interface tailored for cybersecurity professionals. This interface combines qualitative and quantitative metrics, enabling users to assess the security posture of their organization effectively. The design process is informed by insights from semi-structured interviews with Chief Information Security Officers (CISOs) and subject matter experts, ensuring relevance and usability. The paper discusses key design decisions, including the integration of complex framework tree structures, color-coded coverage mappings, and a three-pane view for detailed analysis. Additionally, it explores extended use cases beyond the immediate application, suggesting potential for broader applications in various cybersecurity and compliance contexts. This work aims to enhance decision-making in cybersecurity management and inspire future research and development in cybersecurity and data visualization tools

An overview of cybersecurity in Zimbabwe’s financial services sector

Background: As nations, businesses, and individuals rely on the Internet for everyday use, so are cybercriminals manipulating systems to access information illegally and disrupting services for financial gain. The global cost of cybercrime eclipsed one trillion US Dollars in 2020, with Africa losing US $3.5 billion. Methods: A quantitative research methodology was adopted to investigate factors affecting cybercrime in Zimbabwean financial institutions. The study focused on the technical aspects of cybersecurity. Data were collected from July 2022 to October 2022, targeting technology experts in the financial services sector. Participants were recruited from 13 institutions to rank cybersecurity constructs, frameworks, and challenges associated with cybersecurity. Data was collected using a questionnaire distributed to participants. Descriptive statistics were used to extract meanings from the responses that measure mean and standard deviation. Results: Network and data security were the most highly ranked cybersecurity constructs, while physical security was the least. The top three barriers are increasing sophistication of threats, limited skills and emerging technologies, while lack of executive support was the least. The top frameworks used are the Information Technology Infrastructure Library (ITIL) and Control Objectives for Information and Related Technologies (COBIT), while a fifth is yet to adopt cybercrime frameworks. Conclusions: The study proposes that financial institutions establish a cybersecurity culture to fight cybercrime, addressing cybersecurity barriers and following best practices. Financial institutions should invest in cybersecurity technologies, train security specialists, and employ a Chief Information Security Officer (CISO). The study’s small sample may affect the generalisability of the results. Financial institutions should implement strategies to raise awareness and collaborate with institutions to train cybersecurity security specialists to close the skills gap.

Chief Information Security Officer

Chief Information Security Officer

Information Visualization for a Comprehensive Cybersecurity Risk Quantification and Measurement

This paper presents an innovative dashboard design for cybersecurity risk management, addressing the urgent need for effective visualization and quantification of cyber threats in organizations. Through semi-structured interviews with security executives, we identify key challenges in cybersecurity operations and propose a user-centric dashboard. This tool integrates an overall risk score, trend analysis, global threat mapping, and a three-step workflow from risk insights to remediation, all aimed at enhancing decision-making for Chief Information Security Officers (CISOs) and their teams. Usability testing underscores its effectiveness and user-friendliness, signaling a significant step forward in cybersecurity risk management by providing a comprehensive, intuitive, and actionable overview of an organization’s security posture

Design and evaluation of a self-paced cybersecurity tool

PurposeThis paper aims to present the evaluation of a self-paced tool, CyberSecurity Coach (CYSEC), and discuss the adoption of CYSEC for cybersecurity capability improvement in small- and medium-sized enterprises (SMEs). Cybersecurity is increasingly a concern for SMEs. Previous literature has explored the role of tools for awareness raising. However, few studies validated the effectiveness and usefulness of cybersecurity tools for SMEs in real-world practices.Design/methodology/approachThis study is built on a qualitative approach to investigating how CYSEC is used in SMEs to support awareness raising and capability improvement. CYSEC was placed in operation in 12 SMEs. This study first conducted a survey study and then nine structured interviews with chief executive officers (CEOs) and chief information security officers (CISO).FindingsThe results emphasise that SMEs are heterogeneous. Thus, one cybersecurity solution may not suit all SMEs. The findings specify that the tool’s adoption varied quite widely. Four factors are primary determinants influencing the adoption of CYSEC: personalisation features, CEOs’ or CISOs’ awareness level, CEOs’ or CISOs’ cybersecurity and IT knowledge and skill and connection to cybersecurity expertise.Originality/valueThis empirical study provides new insights into how a self-paced tool has been used in SMEs. This study advances the understanding of cybersecurity activities in SMEs by studying the adoption of CYSEC. Moreover, this study proposes significant dimensions for future research.

Managing Variable Cyber Environments with Organizational Foresight and Resilience Thinking

Combining business continuity management (BCM) and systematic cyber threat intelligence (CTI) can improve cyber situational awareness to support decision-making through the phases of the resilience cycle (plan, absorb, recover, adapt) to ensure the continuity of organizational operations when encountered by cyber disruptions. End-user needs, human factors, high ethical standards, and social impacts can best be adapted when professionals from different fields work together with end-users to refine and co-develop selected tools into a platform. A resilience assessment that combines BCM and CTI enables 1) quick or detailed assessment of the investigated industry and its critical processes, 2) measurement of performance goals based on information received from end users, where artificial intelligence-based self-learning approaches can be used for functional descriptions, 3) information on the sensitivity of the investigated industry and vulnerability and 4) resilience and BCM throughout the entire resilience cycle. A new Horizon Europe project DYNAMO (Dynamic Resilience Assessment Method including a combined Business Continuity Management and Cyber Threat Intelligence solution for Critical Sectors) works towards combining BCM and CTI to generate a situational picture for decision support. Having this in mind, certain cybersecurity and BCM tools will be developed, refined, and integrated into the DYNAMO platform to provide decision support and awareness to chief information security officers, cybersecurity practitioners, and other stakeholders. This paper reports a case study that explores how combining CTI and BCM can help in the case of a cyber-attack. The research material consists of the news articles by the largest newspaper in Finland, Helsingin Sanomat (HS) of how the cyber attack against the therapy center Vastaamo progressed during the first week after the attack. The results show that cyber threat intelligence when flexibly integrated into the BCM approach could create better conditions for improved organizational foresight to react to unpredictable cyber threats to ensure business continuity.

Captcha-Based Honey Net Model against Malicious Codes

The rate of passive and active attacks has been on the increase lately affecting both individuals and institutions. Even when internal control procedures are in place, malicious codes from intruders into the network have left so much to be desired. As a result, many Chief Information Security Officers have grown grey hair because of their inability to effectively handle attacks from various ends. Various attempts and technologies have been made in the time past with a measure of success. Intrusion Detection Software (IDS), Intrusion Prevention Software, firewall, honey pots and honey nets have been deployed and with great respite from losses arising from cyber-attacks. Cyber security is the duty of everyone and all must see it as such. As tiers of government and law enforcement agents are doing their best, everybody must be seen to play their parts. Fraudsters have also not seemed to be tired of seeking vulnerabilities to exploit. Then, cyber security experts should not let off their guards but make efforts to harden their security. A way of doing is to intelligently provide a solution that has the capability of detecting and proactively hardening security. This paper proposes a honey net model that is captcha-based and capable of extracting details from hackers with a view to building a robust defense against black hat attackers. This research was able to prevent the botnet with the use of captcha and also redirect suspected traffic to the honeynet which was then captured for the purpose of improving the security of the network. The result showed that any bandwidth greater than the set threshold was not allowed to go into the network but redirected to honeynet where details were logged. Also, with a threshold of 100 mbs, inbound traffic of higher bandwidth such as 110 mbs and 150 mbs was denied access thereby giving 100% detection rate.

"Cyber security is a dark art": The CISO as Soothsayer

Commercial organisations continue to face a growing and evolving threat of data breaches and system compromises, making their cyber-security function critically important. Many organisations employ a Chief Information Security Officer (CISO) to lead such a function. We conducted in-depth, semi-structured interviews with 15 CISOs and six senior organisational leaders, between October 2019 and July 2020, as part of a wider exploration into the purpose of CISOs and cyber-security functions. In this paper, we employ broader security scholarship related to ontological security and sociological notions of identity work to provide an interpretative analysis of the CISO role in organisations. Research findings reveal that cyber security is an expert system that positions the CISO as an interpreter of something that is mystical, unknown and fearful to the uninitiated. They show how the fearful nature of cyber security contributes to it being considered an ontological threat by the organisation, while responding to that threat contributes to the organisation's overall identity. We further show how cyber security is analogous to a belief system and how one of the roles of the CISO is akin to that of a modern-day soothsayer for senior management; that this role is precarious and, at the same time, superior, leading to alienation within the organisation. Our study also highlights that the CISO identity of protector-from-threat, linked to the precarious position, motivates self-serving actions that we term 'cyber sophistry'. We conclude by outlining a series of implications for both organisations and CISOs.

Limited usefulness of firm-provided cybersecurity information in institutional investors’ investment analysis

PurposeThe purpose of this study is to examine how financial analysts deal with cybersecurity information in their investment analysis process and whether they find cybersecurity disclosures in companies’ financial reports useful.Design/methodology/approachInvestment managers/financial analysts and chief information security officers (CISOs) at seven institutional investors were interviewed.FindingsNot all financial analysts consider cybersecurity risk in their investment analyses. Those who do look at company strategy, how the company integrates cybersecurity into its processes and whether it has certified its cybersecurity information. The financial analysts use this qualitative information to adjust the results of their quantitative analysis. They do not find boilerplate or cursory cybersecurity information in financial reports to be useful. In fact, they view it as unreliable and prefer drawing on other information sources to assess the company’s cybersecurity risk.Practical implicationsThe results of this study highlight to securities regulators that reported cybersecurity information is of limited usefulness. Regulators are challenged to revisit their disclosure requirements. Companies wishing to improve the usefulness of their cybersecurity information should provide more company-specific information.Originality/valueTo the best of the authors’ knowledge, this study is the first to look at financial analysts’ perception of cybersecurity-related information. It complements findings from prior market studies by adding new insights into the way influential market participants deal with this information in their investment analysis process.

ON HIRING A CISO: CHANGES TO GRAMM-LEACH-BLILEY’S “SAFEGUARDS RULE” MANDATE HIRING OF A QUALIFIED INDIVIDUAL TO MANAGE ORGANIZATIONAL SECURITY

Pending changes to the Gramm-Leach-Bliley-Act "Safeguards Rule" will soon mandate the hiring of a qualified individual to manage firm IT and security needs. This requirement will force many firms to hire a Chief Information Security Officer ("CISO") for the first time. Due to the uniquely difficult nature of a CISO's role, the dearth of available talent, and the high costs associated with hiring a qualified professional, firms require a sound understanding of elements to consider in making this choice. In this light, this paper examines essential in-depth factors to consider in finding and retaining the right CISO. While finding the right CISO is a tough challenge, hiring the right person should yield substantial positive contributions to organizational security and the best interests of stakeholders, clients, and the firm itself.