CISO’s perspectives – The 4 recommendations to sleep without a worry

1. Sleeping-well CISO: myth or reality?

Considering the countless cyber threats that go on, what threat keeps you up at night?

This is THE one-billion-dollar question for CISOs today! People suppose we do not sleep well at night because of all the cybersecurity threats around us that target our business. Certainly it’s true that in the past three years there has been a massive increase in terms of attacks against all types of organizations. Additionally in the IT sector we are being highly targeted because we are supplying products and services to customers. Although I sleep much better than a couple of years ago.

We now have consolidated our security and have years of experience protecting ourselves and our customers.

Nevertheless, I must admit that what can wake me up at night is the “unknown”. Especially the unknown unknowns, as well described by Donald Rumsfeld. In cybersecurity there are threats that we know we know, and we protect against these threats (with mitigated success sometimes). Also, elements that we know we don’t know: for example, servers that didn’t go through the standard registration process. In this situation we can design cyber solutions and countermeasures on the known unknowns but the last category of the unknown unknowns are representing the most complex area to address for Cyber experts.

Of course, we invest in Cyber Threat Intelligence, cybersecurity knowledge, red teaming, understanding of the fast-evolving and complex landscape to protect (mapping IT systems), risk assessments and risk analysis, to ensure that we reduce to the minimum what we do not know. But still there are parts that we don’t know, we don’t know. These unknown unknowns are threats that we have no choice to “accept”, with risk to discover once they started to materialize. The only way to reduce the unknown unknowns is to constantly challenge your defense and learn from the others.