5 tough lessons about conveying security risks

A CISO at a large manufacturing company walked out of a board meeting last year fully expecting to be fired after giving a presentation on security.

He had spent about a year in the CISO role and had gone into the board meeting thinking he was doing the right thing – giving members the brutally honest truth about what was wrong with the company’s information security.

“Success for them would have been for me to come in and say, ‘Don’t worry about it. I’ve got it covered.’ But that was not the case,” he recalls. “We were really starting at a very low maturity level,” with few resources and little interest in security issues. So he gave them his diagnosis.

To read this article in full or to leave a comment, please click here