Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility.

But is that fair – or even right?

After all, the most common sources of data breaches and other cyber incidents are situations caused by employees: weak passwords, phishing emails and social engineering attacks. Are CISOs unfairly scapegoated, both in the workplace and in the courtroom? Are they shouldering the weight of cyberattacks because leadership cares more about public relations?

At the end of the day, boards of directors and high-level executives want to show their stakeholders and customers that not only is someone being held responsible, but it is also the person with the word “security” in their job title. Ultimately, this may make organizations more vulnerable to attack.

CISOs On Trial

“Every time there’s a high profile breach, business needs a fall guy,” Stuart Mitchell, head of information and cybersecurity recruitment at Stott and May, told CIO Dive.

At one time, the CEO bore the responsibility for a cyber incident and its aftermath. But increasingly, CISOs have become that fall guy. Not only are they losing their jobs, they often face legal culpability for their organizations’ data breaches. This creates a precedent that could put cybersecurity at greater risk.

Often a CISO may not control all the factors which affect their organization’s security. For instance, consider a company’s funding allocation. A study from RSA 2022 found that organizations are spending a lot of money on security tools, but they aren’t always the best or most effective. This is because the CISO isn’t necessarily the one making the decisions about which security systems a company needs. The final call often comes from someone higher in the executive path who lacks the technical background to choose wisely.

Let’s take a closer look at two major cyberattacks: SolarWinds and Uber.

SolarWinds and Uber: Setting a New Precedent

The SolarWinds data breach has become the new standard of how devastating a supply chain cyberattack can be. Threat actors first gained access to the SolarWinds network in September 2019. However, the attack went undiscovered until December 2020: much longer than the industry average of 95 days. The consequences were severe.

The breach impacted organizations in both government agencies and the private sector. The company took a major reputational and financial hit, resulting in dropping stock value, which led stockholders to sue. They claimed SolarWinds violated the Exchange Act, and that leadership misrepresentation led to financial losses.

The SolarWinds CEO was initially part of that lawsuit, but the judge overseeing the case dropped him from the claim. The CISO, however, still faced liability along with the CFO and financial representatives.

“The biggest item is that the judge did not dismiss the part of the lawsuit on the CISO’s personal liability for the breach,” John Bambenek, Principal Threat Hunter with Netenrich, told Security.

The second case involves the former CSO for Uber. Unlike the SolarWinds lawsuit, this was a criminal trial stemming from the 2016 data breach that exposed the personally identifiable information of millions of drivers and customers. The CSO was found guilty of obstructing justice for failure to report the data breach and making payments to the attackers. Neither the CEO nor any other person in leadership at Uber was held to the same standard of responsibility.

As Forbes pointed out, the government “amplified the prevailing notion that the CISO/CSO should be blamed for any major cyber event.”

CISOs in the Court of Public Opinion

The Uber conviction took many cybersecurity professionals by surprise. It also raised new concerns about what happens in the aftermath of a data breach.

Holding someone accountable for a high-profile cyber incident looks good to the public, who are increasingly concerned about the security of their personal information. Data breach remediation policies often include how to best spin the incident to the public. After an attack, showing that someone is to blame gives the appearance of the organization taking responsibility.

Perhaps that appeases the general public. But it is the stakeholders standing to suffer personal financial loss who hold the most sway. The SolarWinds lawsuit showed that they want accountability; a judge decided that accountability lies with the CISO rather than the CEO or anyone else.

But putting all the weight of a data breach on the shoulders of the CISO to the point of criminality or personal liability could result in weaker security across the spectrum. “Personal liability for corporate decisions… will lead to a lack of interest in our field, and increased skepticism about infosec overall,” Dave Shackleford, owner of Voodoo Security, told The Washington Post.

There’s already a serious talent shortage. Making the CISO personally liable for breaches could cause fewer people in the security industry to move into leadership roles. In turn, responsibilities will spread across different leadership positions, with no one willing to add the word “security” to their job title.

More from CISO

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

Do You Really Need a CISO?

2 min read - Cybersecurity has never been more challenging or vital. Every organization needs strong leadership on cybersecurity policy, procurement and execution — such as a CISO, or chief information security officer. A CISO is a senior executive in charge of an organization’s information, cyber and technology security. CISOs need a complete understanding of cybersecurity as well as the business, the board, the C-suite and how to speak in the language of senior leadership. It’s a changing role in a changing world. But…

2 min read

What “Beginner” Skills do Security Leaders Need to Refresh?

4 min read - The chief information security officer (CISO) was once a highly technical role primarily focused on security. But now, the role is evolving. Modern security leaders must work across divisions to secure technology and help meet business objectives. To stay relevant, the CISO must have a broad range of skills to maintain adequate security and collaborate with teams of varying technical expertise. Learning is essential to simply keep pace in security. In a CISO Series podcast, Skillsoft CISO Okey Obudulu recently said,…

4 min read

The Needs of a Modernized SOC for Hybrid Cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

5 min read