Why should enterprises adopt a top-down approach for their cybersecurity?

If, like me, you tend to check the news every morning, you'll know that cyber attacks and breaches are reported pretty much daily. Somewhere between your bagel and your coffee, you're left shaking your head as yet another company falls victim to malicious intent. As we become increasingly familiar with the growing complexity of threats, we also grow to expect our organisation to be next. Thus, a number of solutions, namely AI and cloud applications, have taken centre stage as mitigators. However, could we better our chances much sooner than deploying a new solution? Recently, conversation has been brewing that a 'top-down' approach can give your organisation a better head start. What does this mean, and how?

Let's take it from the top

Within many organisations, there is a misapprehension that cybersecurity is a problem for the IT department. On the other hand, the evolving threat landscape has led to a change in philosophy elsewhere. Many business executives have joined in the cybersecurity chatter with the intent to protect the business's most important assets. As a result, security positions such as CISO are commonplace among the board. By having someone at the top voicing data concerns, the heads of the business gain a better understanding of why it's so important. However, with the lines blurred about who is responsible for cybersecurity (CISO or IT?), top-down may be the best way to delegate. The top-down approach shines a spotlight across the business on the impact of cyber risk. By starting at the top, you can encourage cybersecurity initiatives to be employee-wide. You begin with the CISO, who is typically responsible for deploying a top-down approach. They must update and involve everyone across the business about their cybersecurity endeavours and any breaches. The CISO should also encourage staff to undertake general awareness training. In turn, the workforce are likelier to treat cybersecurity as more of a priority. In their training, staff may even learn how to identify breaches themselves.

A united front

By getting as much of your organisation involved as possible, you already stand a much better chance against evolving threats. Teaching teams to identify and even stop breaches, and why this is important, puts you in great stead against attacks. Not only this, but by engaging your legal department, you can better ensure you remain compliant with their expertise. Bonus! Cybersecurity requires transparency, and by making it a team effort, you quickly catch up (if not entirely) with what all those expensive solutions can offer you. Of course, you'll still need a bit of AI here and there, but with top-down, you'll better your chances and your company culture.

Enjoy this piece? Why not check out our CxO of the Week?