Legacy data on old servers creates massive privacy risks that boards often ignore. A CISO explains why cybersecurity and privacy are different problems that need separate attention, using a house deed analogy: some data deserves a locked box, not just legal compliance checkboxes.
a lot of research on those types of things. And a lot of the times when you read really deeply into like, how did this data breach happen, right? And a lot of it is, you know, oh, it's the old data on the old server and no one cared about, you know. But a lot of those things that maybe didn't have a high business value, no longer they have a high privacy or cyber risk. And so, wow, almost all of them are a result of that.
Well, thank you so much for bringing in, uh, cybersecurity, because it seems like there's a lot of overlap between privacy and cyber? How should Chief Information Security Officers like myself, or security leaders and executives, really frame privacy as a board-level concern, like you mentioned earlier, not just a legal compliance?
Yeah, I think, you know, I tell people that cybersecurity and privacy have a symbiotic relationship, right? So there is some overlap, but they are not the same. And so companies, when they're thinking about privacy, privacy and cyber to me are like horizontal to the organization, right? So it could possibly touch almost any type of data that you're using with the organization. And just to simplify it for boards, I've spoken with companies all over the world about this. You know, what you need to know is that data that has some type of regulatory or even consumer concern around it, around privacy needs some type of special handling or special consideration. So if you think about it that way, I think it will help you understand. It's not like, let's say you have your house, let's say you have your house and you have a key to your house, right? Like maybe your deed to your house is locked in a box or in a special place, right? It's probably not on the coffee table. It's not like plaster on the window. So thinking about your data in that way and how you want to protect certain things in maybe a special way or a different way, that's really what privacy is.
Wow, that's pretty cool. It reminds me of what we've learned in the Navy, defense in depth, right? So you have different control to, I guess it, in my opinion, if a bad guy has the resources and they have a desire, right? They can almost get to any data they want really if they have the time
