|
Paul Proctor, distinguished VP analyst at Gartner, wants organizations to know they’re thinking about their cybersecurity investments incorrectly. Rather than focusing on factors beyond their control, he said, companies should set measurable levels of risk appetite. For instance, they might decide what they consider an acceptable window of time for patching a network vulnerability.
Finance leaders must also consider all the costs that go into cybersecurity investments, which include factors like including “business friction” like the loss of productivity when employees must repeatedly authenticate themselves on their computers, Proctor said.
CFO Brew sat down with Proctor at the recent Gartner CFO & Finance Executive Conference to get his thoughts on how CFOs and other leaders can improve the way they and their boards discuss cybersecurity.
This interview has been edited for length and clarity.
What areas of cybersecurity are CFOs concerning themselves with?
I would characterize it as the wrong things. Here’s the problem with any senior non-IT executive: They treat security like magic and security people like wizards who cast spells to protect the organization, and when something goes wrong, [they] fire the wizards. This is the way it’s always been done.
Keep reading here.—AZ
|