- In terms of immediate actions, boards should start with board education to bring everyone up to the same cyber literacy level. Boards may also want to consider assigning a specific committee to own cybersecurity oversight.
- Additionally, board members should seek to understand what the costs are and the budget impact will be of bringing the company’s cyber systems up to a level that correlates to the cost and risk tradeoff of what the company can accept as the possible loss for the business. Every industry will have different areas of emphasis. For example, protecting intellectual property may not be as big an issue in a retail business as it is in a pharmaceutical business.
- One of the most basic foundational tools that is widely accepted and recognized for performing cyber oversight, and that boards need to understand, is the NIST framework. The NIST Cybersecurity Framework is an oversight tool that breaks cyber risk into five categories and reviews the corporation’s cyber posture and readiness to protect the corporation from a cyberattack. The NIST framework is often used by boards as a scorecard tool to review cyber resilience and readiness, and to rate and identify areas of strength and areas for concentration of resources to improve. Directors will be well served to do a review of the NIST Framework with the full board.
- JULY 18, 2023
- //
- CYBERSECURITY
On July 11, 2023, Microsoft disclosed that a group of Chinese hackers had broken into some of its customers’ email systems to gather intelligence. The hackers, who Microsoft identified as Storm-0558, were able to gain access to the accounts of government agencies and individuals in the United States and Europe.
The hackers exploited a vulnerability in Microsoft’s cloud email service to gain access to the accounts. They were then able to use stolen credentials to access other accounts. The hackers were able to steal a significant amount of data, including emails, documents, and other sensitive information.
Microsoft has since patched the vulnerability and blocked the hackers’ access to the affected accounts. However, the full extent of the damage is still unknown. The company is working with law enforcement to investigate the incident.
The Microsoft data breach is a reminder of the growing threat of cyberattacks from bad actors. It is important for businesses to take the necessary steps to not only protect their data from cyber threats but to also be prepared with a remediation plan should a breach take place.
This breach has set off warning alarms for many boards of directors.
Public company directors know their role is to perform oversight of the corporation. This includes reviewing the operating plans, going over financials, and the foundational responsibility of mitigating risk.
Many boards are now focusing on coming up the cybersecurity learning curve in anticipation of the proposed new SEC regulations on board of directors’ cyber compliance.
- PRINT:
- SHARE THIS :
