Pretend you are the Chief Information Security Officer (CISO) of a large company

Question

Pretend you are the Chief Information Security Officer (CISO) of a large company in the financial services sector (a bank or investment firm). Using the material learned in this course, from the textbook or articles, write a minimum 2 page paper answering the following questions:

1) List and describe 3 cybersecurity challenges your company might face over the next 5-10 years. How might your company combat these challenges? Support your answers with references from the text or course articles.

2) Have cybersecurity challenges changed over the past ten years? In what ways have they changed? Support your answers with references from the text or course articles.

Submit your paper as a MS Word document. No cover page or abstract is required. A reference list IS required, but does not count toward the minimum length.

Explanation / Answer

As a CISO, main responsibilities include ensuring proper protection for all physical and technical aspects of the organization. Technical aspects include securing communications, applications, and business systems to perform risk assessments of IT assets exposed to outsiders on the Internet. Physical aspects including non-electronic factors such as physical site access as well as drafting policies and procedures for secure daily operations. CISO’s are also responsible for security management activities which include training others for security awareness, purchasing security products, planning for and managing disaster recovery, developing secure business and communication practices, and ensuring all policies are followed. Also, a CISO must ensure that security breaches are not a result from any of the changes made in order to protect the organization.

3 Cyber security challenges:

Insider Threat

While many organizations focus their security efforts on their network border, it is the insider that probably poses the most risk to cyber-security. Right from executives to IT administrators to partners, many people have access to sensitive data that if publicly exposed. People have a tendency to trust people they know, leading them to share passwords or other information that they shouldn’t. Trust is an essential element to operating any type of organization. People need access to sensitive information and critical systems for many reasons and a level of trust has to be associated with that access. Understanding and managing that trust is the most critical—and difficult—challenge of dealing with insider threats.

Cyber-security is usually thought of as a technical field, with highly-skilled defenders seeking to outwit attackers in a contest of intellect and will. While there is some truth to this characterization, it misses what is perhaps the most important aspect of security: the human element.

Insiders can maliciously or unwittingly steal, erase, or expose sensitive data for a variety of reasons. At the same time, insiders must be given a certain level of access in order for a business to function or an organization to operate. It is critical to understand insider threats at multiple levels, from motivations to damaging examples to how the threat has evolved, in order to intelligently approach risk mitigation strategies. There are different categories of Insider threats such as Malicious Insiders, Exploited Insiders and Careless Insiders.

Confidential Data (Customer Data)

Customer data is said to be very confidential which has to be protected and not to be obtained without your permission. This may include

Vulnerabilities

Vulnerability is a weakness which allows an attacker to reduce a system's information assurance. A security risk may be classified as a vulnerability.

When trying to gain unauthorized access to a system, an intruder usually first conducts a routine scan (or investigation) of the target, collects any ‘exposed’ data, and then exploits security policy weaknesses or vulnerabilities. Vulnerabilities and exposures are therefore both important points to check when securing a system against unauthorized access.

Cybersecurity Challenges over past 10 years:

Below are the list of categories which falls under the Cybersecurity Challenges:

Related Questions

Navigate

• Browse (All)
• Browse P
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.