November 11, 2015 By Christophe Veltsos 3 min read

In October 2015, the New York Stock Exchange (NYSE) released a book, “Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers.” While the book’s targeted audience does not include chief information security officers (CISOs), we examined it to determine if it could prove valuable to that audience.

The cover bears the names of two well-respected organizations in the security industry, Georgia Tech’s Institute for Information Security and Privacy, and the Internet Security Alliance. Available in both PDF and e-book formats, the book totals 355 pages, which includes nearly 30 pages of profiles for contributing authors and businesses. Each chapter is also available for individual download online.

While the word “definitive” appears in the title, the book’s disclaimer warned against taking advice at face value: “It should not be relied upon as a substitute for specific professional advice. Professional advice should always be sought before taking any action based on the information provided,” the guide stated.

What’s in the Book?

The Introduction

The book’s introduction is provided by Tom Farley, president of the NYSE, who opens with, “No issue today has created more concern within corporate C-suites and boardrooms than cybersecurity risk.” For those who still think of cyber risks as an IT issue, Farley said, “Today, managing cybersecurity risk has expanded far beyond the realm of IT; it has become a business continuity necessity to ensure shareholder value remains intact and that privacy and corporate intellectual property is protected.”

Having specifically called out the importance of cyber risks to ensuring shareholder value and the stability of the markets, notably by addressing the threat of systemic disruption, he also cautioned companies to remain vigilant. This was not just from a technology perspective, but also from a human perspective, adding that companies need to improve the impact of their security training and awareness programs.

The Foreword

The foreword, authored by Visa’s CEO Charles W. Scharf, outlined some key aspects of effective security programs. The first is to “be open and honest about the effectiveness of your security program and regularly share an honest assessment of your security posture with the executive team and board.” This is an interesting point: Many CISOs will share, in private, how their executives may not be so open to receiving or sharing an “honest assessment” of security posture.

Scharf even shares with the reader the five categories Visa’s security program is scored on: risk intelligence, malware prevention, vulnerability management, identity and access management and detection and response. He noted that scores may increase or decrease depending on the company’s defenses as well as on how relevant threats change.

The second recommendation he has is to “invest in security before investing elsewhere.” This is obviously something that executives and boards will need to digest further, but it sets an important tone for the funding of security programs. He finished the section by stating that cybersecurity “is an area where there are no grades — it is pass or fail, and pass is the only option. Cybersecurity needs to be part of the fabric of every company and every industry, integrated into every business process and every employee action. And it begins and ends at the top.”

The Content

The rest of the book is organized into 10 major sections, including the unnumbered introduction:

  • Introduction: The Cyberthreat in the Digital Age
  • Section I: Cyber Risk and the Board of Directors
  • Section II: Cyber Risk Corporate Structure
  • Section III: Cybersecurity Legal and Regulatory Considerations
  • Section IV: Comprehensive Approach to Cybersecurity
  • Section V: Design Best Practices
  • Section VI: Cybersecurity Beyond Your Network
  • Section VII: Incident Response
  • Section VIII: Cyber Risk Management Investment Decisions
  • Section IX: Cyber Risk and Workforce Development

What’s the Benefit for CISOs?

While the book is aimed at directors and officers, the hefty page count makes it very unlikely that these people will find the time to read through it all. Security leaders who imagined having long, fruitful conversations with their executives and the board will likely have to wait a few more years before such conversations take place. However, the chapter-by-chapter nature of this book does make it easy for a director or officer to pick up, leaf through and dive into something that catches their eye. CISOs should be ready for that.

So while this book is clearly labeled as being targeted at directors and officers, CISOs and aspiring security leaders should skim through it, take notes and draw inspiration for their next briefing as risk leaders. The book does contain advice from some of the leading minds and businesses on the topic of the management and governance of cyber risks — something that’s an intricate part of the CISO role.

One such chapter that I would recommend to CISOs is the last in the book, titled “Evaluating and Attracting Your Next CISO: More Sophisticated Approaches for a More Sophisticated Role.” As the authors point out, “although the CISO rarely reports directly to the chief executive officer, he or she must have the qualities expected at the CEO-1 level.”

Another benefit that a CISO can draw from having read this book is to then share a particularly relevant section or chapter with other executives and officers while clearly pointing out that the book was written for them.

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today