Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Cybersecurity for Digital Media Industry - Tough Questions to the CISO

31 Mar 2022 · 1 min

Watch on YouTube

1:28

In this advisory talk, Matthew Rosenquist outlines three critical questions that executives in the digital media sector should pose to their Chief Information Security Officers (CISOs). The first question probes the organization’s cyber‑risk goals and the level of risk it deems acceptable, emphasizing that not all risk can be eliminated. The second question delves into the risk assessment process, asking about attacker motivations, likely attack methods, existing controls, and the resulting residual risk. The third question focuses on defining cybersecurity success metrics—both qualitative and quantitative—that are directly tied to the previously established risk goals. Answering these questions reveals the maturity, focus, and accountability of the CISO’s security program and underscores the responsibility for protecting the organization.

Chapters

Here are 3 important questions that digital media industry executives should be asking their CISOs. First, what are the organization's cyber risk goals? And really, you're asking, what are the acceptable risks? Again, we don't eliminate all risks, so what are those acceptable risk goals? The second question is about risk assessment. What are the threats, those motivations and goals of the attackers, right? What are the most likely attacks that they will do, the methods that they're going to try and exploit, and what controls do we have in place resulting in what residual risks are still there at the end of the day? The third question is, what are the cybersecurity success metrics? And this typically is both qualitative and quantitative, and it should be tied to those goals with respect to the risks that they've already outlined. Now, these are some of the toughest questions that CISOs must answer, answer, and it paints a picture of the maturity of their groups' capabilities, focus, and accountability. Responsibility for protecting the organization.