Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
2024 – The year of the CISO
By Jessica Hebenstreit, Faculty at IANS Research
I can already sense the collective sighs and see the predictable eye rolls. Yes, I get it. I, too, am a cynical, grey-haired cyber practitioner. However, if you’d indulge me for a moment, I believe the Chief Information Security Officer (CISO) is standing at the precipice of a transformative era within organizations. The reasons for this anticipated shift are multifold, and I am vigilantly observing and dissecting the below trends that point to 2024 being the year of the CISO.
1. The SEC Lawsuit Against SolarWinds and Tim Brown Demonstrates Increased CISO Accountability:
In the ongoing legal saga involving Tim Brown and the SolarWinds breach, a narrative has emerged suggesting that the Securities and Exchange Commission (SEC) has the CISO in its crosshairs. However, I posit a different viewpoint. Brown’s questionable decisions, conflicting statements about SolarWinds’ security posture, and the sale of stock during the breach’s early stages have thrust the CISO role into the spotlight. This comes on the heels of the case against Uber’s CISO, Joseph Sullivan, earlier in 2023. The increasing publicity surrounding these cases is not only shedding light on the existence of CISOs but also underscoring the personal risks associated with holding such a position. While ethical considerations play a role in these legal battles, the undeniable fact remains: 2023 bore witness to two high-profile legal actions against CISOs, potentially setting a precedent for increased accountability in the role.
2. New SEC Rules on Cyber Event Disclosure Amplifies Challenges in the CISO Role:
A fundamental shift is underway with the recent introduction of SEC rules governing the disclosure of cyber incidents by publicly traded companies. Materiality, a term laden with significance, now demands continuous evaluation throughout the lifecycle of an incident. While the SEC provides a specific definition of materiality, the practical application requires collaboration with legal counsel to align it with an organization’s specifics. Once an incident achieves material status, it must be reported to the SEC within a mere four business days, with minimal exceptions. This newfound enforcement places unprecedented pressure on CISOs. They are tasked with maintaining coherence in internal and external communications, preventing undue alterations to their reports as they ascend the executive hierarchy, and ensuring the fidelity of information flowing from their teams. The heightened scrutiny on breach reporting amplifies the challenges inherent in the CISO role.
3. The CISO Role Will be Elevated to a True Executive-Level Position as Pressures and Risks Soar:
The heightened pressure and visibility of the CISO role are not mere challenges but catalysts for a paradigm shift in how these professionals are perceived and treated within organizations. The spectrum of the CISO role, ranging from a director-level position to a senior executive, has resulted in significant disparities in compensation and benefits. Against the backdrop of increased pressure and personal legal risk, CISOs are poised to demand a commensurate elevation of their role compared to other C-level executives. This elevation may encompass benefits such as Directors and Officers (D&O) insurance coverage, augmented compensation packages, and an expansion of authority and autonomy through direct reporting to the Board of Directors. And all of it will impact the hiring and retention of CISOs.
In summary, this cynical, grey-haired, but seasoned cyber practitioner firmly asserts that 2024 is poised to be the year of the CISO. The confluence of heightened personal risk and increased responsibilities will empower CISOs to assert their worth and demand an elevation to a true executive-level position within companies. This elevation must be accompanied by corresponding benefits and compensation to truly reflect the gravity of their responsibilities. Public companies, particularly, will find it increasingly challenging to attract and retain top-tier CISOs if they fail to recognize and adapt to these evolving expectations. Additionally, non-publicly traded companies may inevitably feel the pressure to follow suit, as they seek to meet the security standards demanded by their customers or industry peers. The winds of change are blowing, and the role of the CISO is set to undergo a transformation that will resonate throughout the cybersecurity landscape.
##
ABOUT THE AUTHOR
Jessica Hebenstreit is a Faculty member at IANS Research & Director of Security Operations and Infrastructure at Eptura. Jessica is an experienced cybersecurity executive, spearheading InfoSec initiatives for organizations across diverse sectors, including IT, financial, and healthcare.
