The Human Element of Security

A valuable component of corporate governance is the risk register. Although it is not mandatory, using a risk register to build a sound risk governance process for an organization is strongly recommended.

Cybersecurity threats are becoming increasingly complex, sophisticated, malicious, well organized and well funded. The widespread adoption of artificial intelligence (AI)-powered tools and technologies will lead to customized, high-impact cyberattacks.

When most organizations think of an insider threat, their focus is on a technically skilled, disgruntled and unethical employee or contractor with privileged access.

Malware has existed for decades. Ransomware has become one of the most financially devastating types of malware attacks and poses a serious threat to agencies, school districts and other organizations

Establishing a brand new process, function or program can be daunting. Some of the challenges include determining where to start, researching whether it has been done successfully in the past and, if it has, discovering the best practices and frameworks that can be used as a starting point.

There is undoubtedly a substantial gap in available cybersecurity personnel to fill the existing open positions, and most researchers believe this gap is only going to grow without a significant change in how personnel are recruited into and retained within the field.

Employees are often considered the weakest link in the information security chain, creating both unintentional and intentional security threats for their employers and their employers’ partners and customers.

The United States’ ability to defend and protect itself in cyberspace has evolved at an incredible pace. This evolution has been accomplished largely due to various frameworks such as the US National Cybersecurity Strategy (NCS), Joint Publication 3-12 and Presidential Policy Directive 21.

Computing has penetrated all aspects of everyday life from smartphones, cars, televisions and cameras to home appliances.

A stable mechanism is one that operates consistently and sensibly. Cybersecurity is fundamentally a dynamic sociotechnical mechanism and, due to the human factor, it is vulnerable because human behavior and decisionmaking are complex and often unreliable.

Many organizations, particularly those highly regulated by government entities, such as banking and insurance, employ a Three Lines of Defense model for risk management.

The basic precepts of privacy do not change in the face of catastrophes, but the type and amount of personally identifiable information (PII) used and generated and the need for legitimate access to those data increase substantially.