{"id":32693,"date":"2020-01-09T17:00:23","date_gmt":"2020-01-09T17:00:23","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=90427"},"modified":"2020-01-09T17:00:23","modified_gmt":"2020-01-09T17:00:23","slug":"changing-the-monolith-part-1-building-alliances-for-a-secure-culture","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/changing-the-monolith-part-1-building-alliances-for-a-secure-culture\/","title":{"rendered":"Changing the monolith\u2014Part 1: Building alliances for a secure culture"},"content":{"rendered":"

Any modern security expert can tell you that we\u2019re light years away from the old days when firewalls and antivirus were the only mechanisms of protection against cyberattacks. Cybersecurity has been one of the hot topics of boardroom conversation for the last eight years, and has been rapidly increasing to higher priority due to the size and frequency of data breaches that have been reported across all industries and organizations.<\/p>\n

The security conversation has finally been elevated out of the shadows of the IT Department and has moved into the executive and board level spotlights<\/a>. This has motivated the C-teams of organizations everywhere to start asking hard questions of their Chief Information Officers, Chief Compliance Officers, Privacy Officers, Risk Organizations, and Legal Counsels.<\/p>\n

Cybersecurity professionals can either wait until these questions land at their feet, or they can take charge and build relationships with executives and the business side of the organization.<\/p>\n

Taking charge of the issue<\/h3>\n

Professionals fortunate enough to have direct access to the Board of Directors of their organization can also build extremely valuable relationships at the board level as well<\/a>. As cybersecurity professionals establish lines of communication throughout organizational leadership, they must keep in mind that these leaders, although experts in their respective areas, are not technologists<\/strong>.<\/p>\n

The challenge that cybersecurity professionals face is being able to get the non-technical people on board with the culture of change in regards to security<\/a>. These kinds of changes in culture and thinking can help facilitate the innovation that is needed to decrease the risk of compromise, reputation damage, sanctions against the organization, and potential stock devaluation. So how can one deliver this message of Fear<\/em>, Uncertainty<\/em>, and Doubt (FUD)<\/em> without losing the executive leaders in the technical details or dramatization of the current situation?<\/p>\n

<\/p>\n

Start by addressing the business problem, not the technology.<\/em><\/p>\n

The answer isn\u2019t as daunting as you might think<\/h3>\n

The best way to start the conversation with business leaders is to begin by stating the principles of your approach to addressing the problem and the risks of not properly addressing it<\/a>. It\u2019s important to remember to present the principles and methods in a way that is understandable to non-technical persons.<\/p>\n

This may sound challenging at first, but the following examples will give you a good starting point of how to accomplish this:<\/p>\n