Almost since the birth of computer networking, engineers who build and manage computer systems have needed to figure out how to protect them from both intentional attack and unintentional damage. The deeply technical realities of securing computers and networks created a need for security specialists. Recently, the costs and other implications of attacks have created a seismic shift in how businesses must think about cybersecurity. Responsibility for cybersecurity has expanded from the IT engineer to the boardroom, and it’s not going back.

This past week, Cisco published its Annual Security Report. One of the key areas Cisco calls out is “Changing the View Toward Cybersecurity—From Users to the Corporate Boardroom.” The report highlights the increasing importance of security not only within the technical ranks, but also as part of an organization’s strategic oversight. In fact, according to Cisco, “Strategies include considering new approaches to help align people, processes, and technology, making security a topic at the corporate boardroom level, and adopting more sophisticated security controls…”

As I speak with executives and board members of major enterprises, I’m increasingly hearing the same thing: they agree that it’s time for them to understand how their assets are protected, how their security investments are used, and how their networks are being protected before, during and after attacks. Given the complexity of today’s networks, providing them with answers requires automation. Networks aren’t static because businesses are not static. Useful answers need continual assessment and at least daily reports –describing the changes in the enterprise’s risk profile, access paths, and threats.  When changes occur, the CEO must ask the question, “Is my network more protected today than yesterday?”

As Cisco’s report states, “The future of cybersecurity hinges on boardroom engagement today.” That engagement requires goals and standards, clear communication, succinct information, and continuous improvement in the face of ever-changing business requirements. Furthermore, the report makes clear the questions that the organization must be able to answer: “Boards also need to start asking tough questions about security controls: What controls do we have in place? How well have they been tested? Do we have a reporting process? How quickly can we detect and remediate the inevitable compromise? And perhaps, the most important question: What else should we know? CIOs need to be prepared to answer those questions from the board, in terms that are meaningful and understandable to board members, and also outline implications for the business of any proposed changes..

With RedSeal, you are able to answer those questions, and not merely in terms of the intended design, but in terms of the reality of your network today. Is your network RedSealed?

I was in one of those small, interior conference rooms when it first happened. It was very hot outside, with an obvious threat of another day over 100°F and extreme humidity, as well. But, it felt even hotter in the room. I was there to provide insights to members of the network and security teams for a regional retailer, and only a few minutes into the training, it seemed like everything I said resulted in angry rebuttals. As a pretty easy-going guy, I couldn’t figure out how it was that I had offended the senior network engineer so completely. So, I asked her, “What has you so upset about this information?”

“Simple!” she hissed through clenched teeth pointing across the table, “They are going to just use this to beat me up!”

There, in a nutshell, is a fundamental problem with many IT organizations: different teams have different fundamental objectives and instead of working together and understanding the goals in a more holistic way, they end up in an adversarial relationship, fighting for resources and the favor of the CIO, CFO, and CEO.

It starts with the clear distinction between the role of network operations and security. The network team is responsible for making sure that packets get through. Their phone doesn’t ring as long as everyone gets access to what they need and there are no slowdowns. On the other hand, security is responsible for making sure that some packets do not arrive, protecting network assets from unauthorized access and from potential attacks of various kinds. As a result, the two teams often find themselves diametrically opposed to one another.

The solution to this rests with the CIO as typically the executive responsible for all aspects of the network infrastructure. As a result, the CIO is the place where these divergent objectives join to create a single strategy, and she is the one who can provide the context and vocabulary for unification.

How is this done in your organization? How have you seen it done, perhaps in organizations where it doesn’t work so well (since I’m sure your organization doesn’t have this issue!)? What do you need in order to make sure that the entire IT organization is aligned to the same goals?

Post 3 – What keeps CEOs up at night?

As a CEO, getting a good night’s sleep is harder and harder these days.  We used to worry about competition, labor problems, regulatory issues, financing issues, sales and, if our company was public, our stock price.  In the 21st century there is a new worry – cyber threat.  Cyber attacks are real and they can be devastating.  Cyber threats come in all shapes, sizes, types, and intentions.  And they are, for the most part, completely automated.

Every business depends on its networks, and we have every indication that dependency is increasing at a dramatic pace.  These networks and the technology that makes them run are constantly changing.  They evolve to suit the needs of business, and they are improved in performance and security by new products.  Unfortunately, they are often built without a big view architecture in mind: “just make it work” is often the order of the day.

As CEO, knowing that these networks run more and more of your business, you should be asking your team – is it better today than yesterday?  Is it more secure today than yesterday?  What happened on our network yesterday?

Getting this data in a standard, understandable form is no small task.  Further, because things change often, the CEO needs to know the answer to this question often.  The geeks still build and operate the networks though the business people use them – kind of like cars and roads.  You don’t need to know how they are built, but you do need to know they are safe and reliable.  As CEO, you must care whether your network is safe and reliable and that you have a team in place that can do make it so.