Quote:How do people working in a Chief Information Security Officer (CISO) position or its equivalent view cybersecurity? Which problems do they face? To learn the answers to those questions, Kaspersky Lab surveyed 250 security directors from around the world. Their opinions are very interesting, although I cannot say that I totally agree with all of my colleagues.

Let’s look at the question about measuring the key performance indicators for a CISO. It is no surprise that most respondents said that their main job criterion is the quality and speed of incident response handling. In modern businesses, people tend to stop thinking of cyberincidents as failures of security. It is good to see that most specialists are beginning to understand that incidents are inevitable, even normal. Today, cybersecurity is primarily about the survival of the company.

By survival, I mean having a level of protection that can guarantee that in the case of an advanced persistent threat attack, data leakage, or a massive DDoS, a company can restore itself without serious damages or lose no more than a predefined minimum. In other words, today’s CISOs focus on incident response.

On the one hand, that is really great. Just a couple of years ago, a “zero incident” view of cyberprotection prevailed, and businesses thought that CISOs should be able to shield infrastructure from incidents with an iron-clad guarantee. But on the other hand, focusing solely on reactive technologies is no better. As I see it, CISOs must strike a balance. All elements of adaptive security architecture are important: prevention, detection, response, and prediction.

Full reading: https://www.kaspersky.com/blog/ciso-report/24288/