In today’s world, the frequency and severity of cyberattacks have become the norm. Nation-state threats and ransomware attacks are becoming more frequent alongside advancements in phishing and deepfakes due to new AI-enabled tactics.
As threats continue to evolve, defenses must keep pace. However, an organization looking to improve its defenses is only as strong as its people. Ensuring the right talent is essential to improving its cybersecurity maturity and bottom line.
Cybersecurity cannot be treated as its own business focus – it should be treated as a gateway to an organization’s overall growth and innovation. As business leaders set out to accomplish this mindset, there are many opportunities behind the organization’s security leaders, who can play a pivotal role in driving value.
The emerging standout player is the Business Information Security Officer (BISO), essential in securing cyber initiatives’ interest and funding, allowing leaders to rethink their methods and invest in strategies that prioritize proactivity and compliance.
Co-founder & chief scientist at ExtraHop.
An up-and-coming concentration in cybersecurity
Recent research found that more cyber leadership teams want to add the BISO role to their bench, but while broader industry adoption remains slow, the role is still on track to becoming a crucial part of an organization’s security function.
Acting as the liaison between security teams, business units, and the C-suite, the BISO works closely with the CISO and CIO to understand current risk and identify areas of improvement. They handle everything from risk management and threat monitoring to third-party assessments and recommending cyber investment opportunities. These investments that meet security expectations and budget requirements will produce a greater ROI in the long run.
As the role is adopted widely, more organizations will benefit from an individual who understands the connection between securing the business and aligning plans to meet broader goals. Identifying ways to drive security proactiveness – and wider business success – also helps gain trust among stakeholders.
What does the ideal candidate look like?
A capable BISO is both a strategic leader and a cyber tactician. Success in the role hinges on a deep understanding of cybercriminal tactics and anticipating threats before they materialize. The most impactful BISOs also bring a blend of adaptability to changing attack methods, as it’s critical that the individual can understand the true cost of risk to bolster resilience.
The BISO is responsible for quantifying the cost of a cyber incident and the price of risk compliance. This approach helps them make pragmatic, data-driven decisions about what to protect and how to protect it – and communicate that to the rest of the business.
A pragmatic mindset also helps a good BISO make better risk management decisions that protect a company in the long run. Armed with this approach, the BISO will then make the case to the C-suite that investing in security tools ensures operational continuity while being cost-effective.
Emphasizing proactive risk management
As part of the role, BISOs must continuously examine the cyber tech stack and risk levels to determine the solutions and strategies that will result in the best ROI for teams and the broader business. Approaching this from the business lens enables them to make strategic decisions that best support productivity while meeting requirements.
Take the rise of ransomware and extortion attacks as an example. The BISO must take notice of the legislation, fees, and legal recourse that result from a cyber incident. The reality of today’s business world is it’s a matter of when – not if – an incident occurs, often resulting in a host of direct and indirect costs that significantly impact the business long-term, averaging around $677 million per incident according to recent research. When the BISO understands and communicates current risk and the financial implications, it can be integral in helping leaders invest in the right solutions to remain proactive in cybersecurity.
For example, integrated solutions that address regulatory, legal, and cybersecurity needs make it easier for businesses to manage all aspects of their cyber deployments and compliance requirements. These initiatives match the growing industry shift towards tool rationalization, a modern approach to investments in solutions designed to handle current and future risks while reducing complexity.
As a result, businesses can avoid costs related to remediation efforts, lost revenues, regulatory fines, and other expenses following a security incident.
How they pave the way towards modern cyber hygiene and resilience
As the middleman between security teams and the C-suite, the BISO acts as the organization’s north star to forgo the fear of potential threats and embrace a more confident approach to cybersecurity.
One modern approach is exploring innovative strategies, such as guiding response teams to shift from traditional monitoring, protection, prevention, and recovery methods. Modern techniques, such as isolating threats, allow teams to reduce disruption and maintain operations when faced with vulnerabilities.
The BISO also plays a role in improving employee cyber hygiene through new initiatives. Poor cyber hygiene directly impacted many organizations that suffered an incident in the past year, so it is necessary to oversee regular cyber training across departments and develop stricter employee guidelines.
Measuring impact
Understanding that cyber risk is a business risk is imminent to today’s modern business. The attack landscape is innovating at a rapid scale and increasing regulations around the world are calling for more accountability.
Businesses can’t afford to delay investing in the right tools, strategies, and, most importantly, people. The BISO ensures that high-level business planning aligns with cyber goals. Over the next few years, we’ll likely see more businesses embrace the BISO role as they understand its importance to their continuity.
We’ve featured the best business VPN.
This article was produced as part of TechRadarPro’s Expert Insights channel where we feature the best and brightest minds in the technology industry today. The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/news/submit-your-story-to-techradar-pro
