Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility.

But is that fair – or even right?

After all, the most common sources of data breaches and other cyber incidents are situations caused by employees: weak passwords, phishing emails and social engineering attacks. Are CISOs unfairly scapegoated, both in the workplace and in the courtroom? Are they shouldering the weight of cyberattacks because leadership cares more about public relations?

At the end of the day, boards of directors and high-level executives want to show their stakeholders and customers that not only is someone being held responsible, but it is also the person with the word “security” in their job title. Ultimately, this may make organizations more vulnerable to attack.

CISOs On Trial

“Every time there’s a high profile breach, business needs a fall guy,” Stuart Mitchell, head of information and cybersecurity recruitment at Stott and May, told CIO Dive.

At one time, the CEO bore the responsibility for a cyber incident and its aftermath. But increasingly, CISOs have become that fall guy. Not only are they losing their jobs, they often face legal culpability for their organizations’ data breaches. This creates a precedent that could put cybersecurity at greater risk.

Often a CISO may not control all the factors which affect their organization’s security. For instance, consider a company’s funding allocation. A study from RSA 2022 found that organizations are spending a lot of money on security tools, but they aren’t always the best or most effective. This is because the CISO isn’t necessarily the one making the decisions about which security systems a company needs. The final call often comes from someone higher in the executive path who lacks the technical background to choose wisely.

Let’s take a closer look at two major cyberattacks: SolarWinds and Uber.

SolarWinds and Uber: Setting a New Precedent

The SolarWinds data breach has become the new standard of how devastating a supply chain cyberattack can be. Threat actors first gained access to the SolarWinds network in September 2019. However, the attack went undiscovered until December 2020: much longer than the industry average of 95 days. The consequences were severe.

The breach impacted organizations in both government agencies and the private sector. The company took a major reputational and financial hit, resulting in dropping stock value, which led stockholders to sue. They claimed SolarWinds violated the Exchange Act, and that leadership misrepresentation led to financial losses.

The SolarWinds CEO was initially part of that lawsuit, but the judge overseeing the case dropped him from the claim. The CISO, however, still faced liability along with the CFO and financial representatives.

“The biggest item is that the judge did not dismiss the part of the lawsuit on the CISO’s personal liability for the breach,” John Bambenek, Principal Threat Hunter with Netenrich, told Security.

The second case involves the former CSO for Uber. Unlike the SolarWinds lawsuit, this was a criminal trial stemming from the 2016 data breach that exposed the personally identifiable information of millions of drivers and customers. The CSO was found guilty of obstructing justice for failure to report the data breach and making payments to the attackers. Neither the CEO nor any other person in leadership at Uber was held to the same standard of responsibility.

As Forbes pointed out, the government “amplified the prevailing notion that the CISO/CSO should be blamed for any major cyber event.”

CISOs in the Court of Public Opinion

The Uber conviction took many cybersecurity professionals by surprise. It also raised new concerns about what happens in the aftermath of a data breach.

Holding someone accountable for a high-profile cyber incident looks good to the public, who are increasingly concerned about the security of their personal information. Data breach remediation policies often include how to best spin the incident to the public. After an attack, showing that someone is to blame gives the appearance of the organization taking responsibility.

Perhaps that appeases the general public. But it is the stakeholders standing to suffer personal financial loss who hold the most sway. The SolarWinds lawsuit showed that they want accountability; a judge decided that accountability lies with the CISO rather than the CEO or anyone else.

But putting all the weight of a data breach on the shoulders of the CISO to the point of criminality or personal liability could result in weaker security across the spectrum. “Personal liability for corporate decisions… will lead to a lack of interest in our field, and increased skepticism about infosec overall,” Dave Shackleford, owner of Voodoo Security, told The Washington Post.

There’s already a serious talent shortage. Making the CISO personally liable for breaches could cause fewer people in the security industry to move into leadership roles. In turn, responsibilities will spread across different leadership positions, with no one willing to add the word “security” to their job title.

More from CISO

CEO, CIO or CFO: Who Should Your CISO Report To?

As we move deeper into a digitally dependent future, the growing concern of data breaches and other cyber threats has led to the rise of the Chief Information Security Officer (CISO). This position is essential in almost every company that relies on digital information. They are responsible for developing and implementing strategies to harden the organization's defenses against cyberattacks. However, while many organizations don't question the value of a CISO, there should be more debate over who this important role…

Everyone Wants to Build a Cyber Range: Should You?

In the last few years, IBM X-Force has seen an unprecedented increase in requests to build cyber ranges. By cyber ranges, we mean facilities or online spaces that enable team training and exercises of cyberattack responses. Companies understand the need to drill their plans based on real-world conditions and using real tools, attacks and procedures. What’s driving this increased demand? The increase in remote and hybrid work models emerging from the COVID-19 pandemic has elevated the priority to collaborate and…

Why Quantum Computing Capabilities Are Creating Security Vulnerabilities Today

Quantum computing capabilities are already impacting your organization. While data encryption and operational disruption have long troubled Chief Information Security Officers (CISOs), the threat posed by emerging quantum computing capabilities is far more profound and immediate. Indeed, quantum computing poses an existential risk to the classical encryption protocols that enable virtually all digital transactions. Over the next several years, widespread data encryption mechanisms, such as public-key cryptography (PKC), could become vulnerable. Any classically encrypted communication could be wiretapped and is…

6 Roles That Can Easily Transition to a Cybersecurity Team

With the shortage of qualified tech professionals in the cybersecurity industry and increasing demand for trained experts, it can take time to find the right candidate with the necessary skill set. However, while searching for specific technical skill sets, many professionals in other industries may be an excellent fit for transitioning into a cybersecurity team. In fact, considering their unique, specialized skill sets, some roles are a better match than what is traditionally expected of a cybersecurity professional. This article…