Why should the Board be Concerned with Cybersecurity? | Singapore Business Review - The Latest News, Headlines, Insight, Commentary & Analysis

Why should the Board be Concerned with Cybersecurity?

By David Sajoto

The rapid transition from on-premises to remote workforces in the wake of the COVID-19 crisis will be looked back upon as a world-historical event. For enterprise IT, it was an earthquake that fundamentally changed the landscape on which we stand.

When the pandemic hit, remote working was a trend that was already on the rise. However, even the most forward-thinking companies did not offer remote working for more than a generous handful of their employees.

IT infrastructure was historically built for the castles and moats of yesteryear in which the majority of those using the corporate network would physically be in the office. The future is hard to predict but we can say with a high level of certainty that the moat has dried up and most will not be going back to the castle.

The pandemic not only affected hiring trends in Singapore but also changed the nature of available jobs. About 35% of job vacancies in Singapore last year involved work that could be done remotely, largely for professional, managerial, executive and technician (PMET) roles, according to the Ministry of Manpower (MOM).

Enterprise IT has changed dramatically in the last year, but that does not mean that the conversation has changed the boardroom. Because of the shift to remote and hybrid working, organisations had to increase their security budgets to enhance security barriers against opportunistic cyber attackers.  Requests to increase IT security budgets are often denied, and while many understand the need to move to the cloud, asking the board for additional budget to uproot the company’s current IT infrastructure can prove difficult.

So how do we get to yes? First and foremost, let’s admit that security practitioners and executives often see the world from two very different vantage points - it is difficult for many on the security side to translate their needs into a business outcome. To get the board on board - those points must converge.

Presenting the problems

You might think the mega breaches that regularly fill headlines are a useful reference point. However, using the widespread fear about breaches as a proof point is a blunt and inaccurate tool at best.

Security practitioners are better off focusing on how to convince executives of the objectives that are specific to their organisation, and concentrate the argument solidly around the concept of risk.

Dredging up fear and paranoia is not helpful, but constructive caution is. The board should understand the risk that exists and how it will impact the business. Examples such as new attack vectors or poor employee security practices must be translated into how they directly affect the organisation. Speaking to the positive business effects from improved cybersecurity practices will win over talking technology.

The board will not expect you to fend off every single attack, but they should know that when the day does come - you’ll lead with resilience. That doesn't always mean stopping the fires from starting, but that when the worst does happen, you are ready to slide down the pole and put the fire out before it causes severe damage.

Providing the solutions

The board’s job is to think about the big picture, and oversee business objectives from the top down. From that lofty vantage point, it can often seem like security objectives are getting in the way of business agility. In order to get the board to understand your side you need to show them how security concerns and business objectives align, or better yet improve the bottom line.

Remote work is a perfect example of the relationship between security concerns and business objectives. In the past, remote work was marred by fears around productivity loss and weak controls over network access. Many of those fears have been alleviated over the steady acceleration of remote working worldwide and businesses are starting to see remote working as a positive force. As such, many executives are now planning for a hybrid workforce.

The security concerns, although diminished, still remain.  Without the correct solution in place to ensure they can do so securely, employees will default to their own practices, devices, and preferred apps. This can create access headaches and a Shadow IT problem which can exacerbate security problems.

With distributed networks and employees it becomes increasingly crucial to passively monitor your remote workforce and employ machine learning to automatically understand when behaviour are deviating from normal.

If the board’s business objective is to maintain and ensure a productive hybrid remote workforce moving forward, then security personnel must be ready to help them understand the potential threats to the organisation, as well as employee productivity, and outline a plan that translates technology investments into business language.

When succeeding, security practitioners may be invisible to the business, but be very noticeable when they are not. Frequently seen as an obstacle to growth they need to be seen as a partner to the business.

Security teams must learn how to consistently communicate with the board in the business language that they understand to change perception at the very highest level within your enterprise.

Get Singapore Business Review - The Latest News, Headlines, Insight, Commentary & Analysis in your inbox
Since you're here...

...there are many ways you can work with us to advertise your company and connect to your customers. Our team can help you dight and create an advertising campaign, in print and digital, on this website and in print magazine.

We can also organize a real life or digital event for you and find thought leader speakers as well as industry leaders, who could be your potential partners, to join the event. We also run some awards programmes which give you an opportunity to be recognized for your achievements during the year and you can join this as a participant or a sponsor.

Let us help you drive your business forward with a good partnership!

This included one-off partial distribution of divestment gains of S$20m.
This is attributed to the lower rental reliefs to retail tenants at Festival Walk and higher average occupancy from IXINAL Monzen-nakacho Building.
The Tripartite Committee on Workplace Fairness targets to complete its work by H1 2022.
A total of 811 condos were sold in the last quarter, the highest since Q4 2010.
The SMAs are focused on global infrastructure projects.
The company said their income was driven by its latest acquisitions.
The Jobs Support Scheme has been extended to 18 August.
The bank is now allowing small- and medium-sized enterprises to avail the loan digitally.
And Health Ministry clarifies roadmap in treating COVID as endemic remains.
Inflation for all items meanwhile remained unchanged at 2.4% YoY.
SMEs that qualify for the UOB Start digital pack will be offered six months of free access.
This was supported by grants extended by the government, such as the Jobs Support Scheme.
The group’s profits after tax ballooned by as much as 138.4%.
It is comprised of a 10-, 20-, and 40-year USD Temasek Bonds.
This was linked to the higher average selling prices amidst rising coal prices.