Leaders, time to take action

A new report out from the Ponemon Institute (Exposing theCybersecurity Cracks: A Global Perspective), sponsored by Websense, states: "Eighty percent of respondents say their company's leaders do not equate losing confidential data with a potential loss of revenue, despite Ponemon Institute research indicating the average cost of an organizational data breach is $5.4 million"  Even better: "Forty-eight percent say their board-level executives have a sub-par understanding of security issues."

Regardless of your feelings about surveys sponsored by a vendor, these statements merely being published as any sort of status of how we are doing is now out there in public.  And, it made me really angry.  Not that I am mad that they published it.  No, I am mad because if this is even close to being true, then we as InfoSec Leaders are failing.  And according to this report, we are failing badly.  If that much of senior management still doesn't understand the importance of information security, then we simply are not doing our jobs.

This reminded me of John C. Maxwell's series on the 21 Irrefutable Laws of Leadership, specifically the Law of Influence.  If no one is following you, you're not a leader.  So I have to ask myself: am I providing the right influence?  You should ask yourself the same.  It's OK if we are in fact we are low on the influence scale, or perhaps in one of the other 20 areas of Maxwell's book.  The important part is that we ALL take a moment to examine our weaknesses, and then go do something about them.

Some thoughts on how to do this:

1) Take a leadership class.  Yes, you techies, get out of your comfort zone and learn something about how to improve an important area of our jobs.

2) Teach a class.  We all have strengths as well as weaknesses.  Take some time to teach others what you know so that you can pass along the good stuff.  I am currently developing a class focused on areas that I think are critical for all leaders.

3) Ask for feedback.  Constantly.  OK, don't be obnoxious about it, but ask around.  Get some honest feedback and then think about how to best act on it.

We can't afford to wait, InfoSec professionals.  We are all leaders, in one form or another. If we don't take action quickly, then more studies, breaches and crazy stories that make our profession look silly will occur.  In fact, start right now.  What are your thoughts about this topic?  Share your action plan.

Sent from my iPad=