Skip to main content

When most of us discuss cybersecurity threats, we tend to focus on the threat actor and their tactics, techniques, and procedures (TTPs). 

But lately the conversation has broadened. In the wake of many recent major cyber incidents, the actions taken (or not taken) by the unfortunate organisation’s chief information security officer (CISOs) are under just as much scrutiny as those of the threat actors. CISOs are increasingly being held directly responsible for cybersecurity failings. 

And while this may make life unpleasant for the CISOs in post right now, there is an argument to be made that these recent cases may improve the lot of CISOs to come. 

Your cyber expert
Edward Starkie
Edward Starkie

Director, GRC | Cyber Risk

estarkie@thomasmurray.com

Shreeji Doshi
Shreeji Doshi

Director, GRC | Cyber Risk

sdoshi@thomasmurray.com

Uber, SolarWinds, Sellafield, UnitedHealth 

After the 2016 Uber breach, Uber’s CISO was convicted of fraud after they attempted a cover-up and made a payment of Bitcoin to threat actors. The CISO was found to have obstructed justice by not disclosing the breach to the US Federal Trade Commission (FTC), despite ongoing contact. 

In late 2023, the US Securities and Exchange Commission (SEC) announced fraud charges against the CISO of SolarWinds for misleading investors because they did not disclose “known deficiencies” within the organisation.  

Holding individuals to account for poor practices in business is not new, whatever their role. And it is common for organisations to hold their CISOs to account (or scapegoat them) for poor security practices. Usually this is done using internal HR mechanisms or ends with the CISO resignation.  

Take the recent Sellafield breach that we covered in a previous article. The CISO in that case had been in their position for over ten years but left after Nuclear Leaks showed that the UK nuclear plant had been in special measures since 2022 for, “consistent failings on cyber security, according to sources at the Office for Nuclear Regulation (ONR) and the security services.” (It should be noted that the official position of Sellafield was that its CISO, after more than a decade in post, did not leave because of the revelations.)  

Another step towards holding individuals to account was taken recently in the US, in response to the UnitedHealth Group (UHG) breach, estimated to have cost almost US$2bn.  

Senator Wyden (the current chair of US senate’s committee on finance) has written to the SEC and the FTC, claiming that the CISO and CEO of UHG have contributed to the breach. Senator Wyden describes the CISO as ‘unsuitable’ for their role, despite being experienced in technology and holding an SVP role at Microsoft:   

“One likely reason for UHG’s negligence, and the company’s failure to adopt industry-standard cyber defenses, is that the company’s top cybersecurity official appears to be unqualified for the job. Steven Martin, UHG’s chief information security officer (CISO), had not worked in a full- time cybersecurity role before he was elevated to the top cybersecurity position at UHG in June 2023, after working in other roles at UHG and Change Healthcare. Although Mr Martin has decades of experience in technology jobs, cybersecurity is a specialized field, requiring specific expertise. Just as a heart surgeon should not be hired to perform brain surgery, the head of cybersecurity for the largest health care company in the world should not be someone’s first cybersecurity job.”   

The Senator also highlights the failings of the CEO and the board which, “should be held responsible for elevating someone without the necessary experience to such an important role in the company”. The implication is that there’s a need for ongoing education and a greater level of understanding of cybersecurity required by the UHG board.   

The ‘C’ in CISO does not stand for ‘ceremonial’ 

Boards must realise that CISOs are not ceremonial heads of departments but vital parts of the executive leadership. They are responsible for helping drive the management of cybersecurity risk within their organisations.  

Regulators across all industries recognise this – which is why mandatory cyber incident notification is becoming more commonplace across different regulatory regimes. Such notification requirements will only continue to put the spotlight on individual CISOs and CEOs, and what boards are doing to manage cybersecurity risk.  

In other words, it is past time that the boards that have not yet given their CISOs a seat at the table make room for them. 

Next steps for boards 

  • Board education: Establish a programme for educating the board on cybersecurity issues, topics, and the latest trends. This should include threat intelligence and recommendations for responding to it.   

  • Ensure the competence of the CISO: Establish whether the current CISO is fit for their role, based on their experience and performance. As the UHG case demonstrates, the hiring decision should not be based on the number of years in general technology, but on those spent specifically in cybersecurity.  

  • Director and officer insurance: Check that existing D&O insurance covers CISOs. 

  • Governance review: Review current internal reporting and management of risk to gain an understanding of whether any outstanding identified issues have been resolved or not. Note that understanding the risk is not the same as acting to mitigate it.  

Expectations of the wider management body 

  • Validate third parties: Confirm that any third-party providers of security services have the appropriate experience and skills to do so. 

  • Understand current capabilities: Conduct a review of current cybersecurity capabilities using industry experts who work to an industry recognised framework (NIST CSF 2.0 is perfect for this). Like other reviews, it should be conducted on a regular basis as part of ‘business as usual’ activities. Internally produced reports will be an input for this exercise but should not be considered a replacement.   

  • Threat intelligence: Understand the threat landscape and how specific threats facing the organisation may manifest themselves.  

Final thoughts 

Cybersecurity can no longer be seen as a side-of-desk activity that can be learned and practiced on a part-time basis. Holding CISOs to account will reinforce this message and so should be considered a positive step. Accountability elevates the role; it recognises the importance and impact that cybersecurity can have on a business.  

As with other professions, there will be teething problems that will have to be worked through. But this is something that all other fields have done and is something that will be achieved over time. “Cybersecurity is a board level issue” – a phrase thrown around frequently but without an understanding of its wider context, even though it is now an irrefutable reality. Accountability and professionalism are the price to pay for cybersecurity being a board-level issue.  

Cyber Risk

Cyber Risk

We bring the best of our collective experience, energy and creative power to fiercely safeguard our clients and fortify their communities.

Learn more