Show, don't tell: CISOs encouraged to be security 'influencers' rather than 'enforcers'

Show, don't tell: That's the approach CISOs need to take if they want to better manage cybersecurity in their organisation, according to a new report from KPMG.

The report declares that security leaders should be more like 'influencers' who show their workforce what they can do securely, rather than being 'enforcers' who tell people what they can and can't do.

That approach could be the key to making cybersecurity more user-friendly in the year ahead, stating that security needs to be a shared responsibility that is owned by everyone in an organisation.

"Talking about firewalls, patch management, and data loss prevention — although all critical considerations — makes non-security heads spin," the report notes.

More CISOs are realising that the key to effective communication is to understand and speak the language of the business. Cybersecurity programs need to demonstrate how they support and grow the bottom line.

"Work to change the perception of these requirements from punishment to responsibility. Look for ways to make cyber awareness more engaging, interactive, fun, even game-like, perhaps through augmented reality (AR) or virtual reality (VR). Make it clear that cyber is not here to be a speed bump but to keep everybody safe and cyber teams can do it concurrently.

The report also identifies seven other cybersecurity considerations, including the requirement for a zero trust security model that ties together identity, authentication, resources, devices, and access requests.

Customers, suppliers, and users expect experiences that are frictionless, despite a seemingly never-ending barrage of password changes and identity verification. However, organisations do not always take into consideration issues such as different access requirements - a lack of purpose-built tools designed for this purpose can cause breaches in the security chain.

According to KPMG's ASPAC cyber leader, Matt O'Keefe, zero trust represents a shift of mindset for CISOs and security teams.

"The cyber team assumes compromise in connection with system access, and makes security decisions on the basis of identity, device, data, and context.  With users demanding ever-faster access, and cloud-centric structures expanding the attack surface, existing security solutions and resources may not be formidable enough to adequately protect data as it moves through the network."

The report asserts that the principle of least privilege could be one of the most important steps to protecting data.

"Users, processes, workloads, and applications should only be granted the lowest degree of system resource access rights necessary to carry out their role. For example, web designers don't need access to financial records, and individuals responsible for updating the product listings, don't need admin rights."

It concludes, "Organisations should continue to view the least-privilege access principle as a core element of the zero-trust model.

KPMG's eight key cybersecurity considerations are below.

1. Expanding the strategic security conversation: Change the conversation from cost and speed to effective security to help deliver enhanced business value and user experience.

2. Achieving the x-factor: Critical talent and skillsets: Transform the posture of CISOs and their teams from cybersecurity enforcers to influencers.

3. Adapting security for the cloud: Enhance cloud security through automation — from deployment and monitoring to remediation.

4. Placing identity at the heart of zero trust: Put identity and access management (IAM) and zero trust to work in today's hyperconnected workplace.

5. Exploiting security automation: Use smart deployment of security automation to help realise business value.

6. Protecting the privacy frontier: Move to a multidisciplinary approach to privacy risk management that embeds privacy and security by design.

7. Securing beyond the boundaries: Transform supply chain security approaches — from manual and time consuming to automated and collaborative.

8. Reframing the cyber resilience conversation: Broaden the ability to sustain operations, recover rapidly and mitigate the consequences when a cyber attack occurs.