In this commentary, the speaker argues that while cybersecurity requires the participation of every employee, ultimate responsibility rests with senior leadership, especially the CEO and the C-suite. The speaker criticizes executives who deflect blame onto lower‑level staff, citing the SolarWinds incident where an intern’s weak password was blamed for a massive breach. He outlines the many ways the leadership team defines, funds, and enforces security policies—hiring, training, access control, audits, and risk management—and contends that pointing fingers at subordinates reveals a lack of understanding of this responsibility. The talk concludes with a call for business leaders to own cybersecurity, work proactively with security professionals, and avoid scapegoating, emphasizing that a well‑supported security program should be part of the organization’s risk posture rather than an after‑the‑fact excuse.
Chapters
Cybersecurity is a team sport, but for any organization, the responsibility falls to the leadership board and C-suite. Well, they really shoulder the burden. The CISO may define the goals and drive the operational aspects, but it takes active teamwork and participation across all the employees and especially support from the other C-suite leaders. Now, when I hear of situations where executives point the finger of blame at employees, well, I'm concerned. Case in point, the former CEO of SolarWinds recently indicated that an intern was to blame for a weak password that contributed to the company's products being compromised with spectacular effect. That's just absurd. Think about it from this perspective: who establishes and oversees the intern program? Who vets and hires the interns? Who mandates the intern training? Who defines the security policy for all employees, including the interns? Who determines what access the interns have? Who funds and establishes controls and audits to verify policy compliance? Clients of employees and interns. Who oversees the work of the interns? Management. Who's the leader of management? The CEO. It is all part of the system that is defined and managed by the C-suite, led by the CEO. So when the CEO tries to defer responsibility and redirect blame, It simply highlights how little that CEO understands their responsibility when it comes to cybersecurity. Now, if you're a business leader, understand that you have a crucial part and hold significant responsibility for cybersecurity failures in your organization. You have to step up and be part of the proactive solution rather than contribute to the problem. Stop trying to find scapegoats to blame. Own it. Work with the cybersecurity professionals in your organization to establish and maintain an acceptable posture for risk. When something happens, and it will, it should not be a duck and cover exercise. Rather, it should be managed, and if a well-supported program is in place, it should fall within the scope of what is acceptable. Cybersecurity is, it's a professional discipline, and although it requires everyone to take responsibility and be part of that solution, ultimately senior leadership is accountable for the success or the failure. So no more pointing to subordinates and saying that it's their fault.
