Enterprise Risk Management, 2nd Edition

CHAPTER 31Cybersecurity: Risks and Governance

 

ANDREW KRUPOWICZ, CPA, CA, CISA

CEO, Westown Limited

 

PHIL YOUNG, OSCP

Co-Founder, Evil Mainframe

 

INTRODUCTION

A CEO operating a multinational corporation engaged in manufacturing will usually not be expected to know details of lease finance accounting as there are specialists dealing with niche finance topics, but the executive may nevertheless be expected to understand the difference between assets and liabilities. Similarly, one will not expect board members or the CEO to know how to set up firewall rules on a network appliance or which fork of an update should be used, but in the third decade of the twenty-first century, they should at least have a basic understanding of IT concepts such as the importance of a proper vulnerability and patch management program. This chapter introduces just such an understanding.

The early decades of computing were an era of expensive and slow connections, which meant that corporate records on a computer faced little more risk than paper records in a filing cabinet. If anything, the complexity of early computer systems initially made it more difficult to steal electronic records than paper files.

This situation evaporated quickly with the rapid development of new, faster communications technologies. With the development of modern globalized business networks, operations flourished thanks to the ability to contact trusted counterparties operating in distant locations, and to replicate data ...