Cyber Risk Leadership: What Every Board Needs to Know

Cyber Risk Leadership – Editors' Foreword The area of cyber risk is only just emerging as a discipline in its own right. Those who understand it fully will argue it has always been so, since the inception of the term cyber itself, but only now is it being taken to the heart of business leadership. The author, Paul C Dwyer, begins this book with the simple premise that business leaders already understand risk, just in a different context. Capitalising on this, he takes the position of educating cyber security and cyber risk professionals to contextualise cyber risk for business leaders, in clear, accessible language. This practical, simple, but never simplistic, approach is carried throughout, and is as well applied to international risk frameworks as it is a business dialogue. By calling for a fundamental shift in perspective, to see cyber risk as part of business risk, this book is the beginning of a new way of addressing security, as an outcome of risk management. This book sets out a realistic portrayal, not just of the wider threat landscape, but the cyber risk landscape and where it meets the real world of business risk. It provides the tools necessary for an organisation to identify, assess and understand cyber risk, even as there is so much sensationalism in the media. By demystifying the organisation of criminal gangs behind hacking, as well as exploring the cyber kill chain and fully illuminating the motivations of various threat actors, this book explodes myths, addresses fallacies and brings clarity to areas long shrouded in a fog jargon. A clear, conversational style takes anyone with business knowledge, including the CISO, through both perspectives on the issue, business and technical, to arrive at a new understanding. Even in taking the reader through how to understand, develop and implement policy, the book clearly illustrates how compliance is not security. Drawing together frameworks to illustrate what good looks like, setting out how communication works between business leaders, cyber security, physical security and executives, the book becomes a step-by-step guide to not only understand best practice, but a manual to implement it. The author manages to convey the pace of technological change, amid the turmoil of recent times, to the backdrop of a spectrum of threat actors, without hysteria. Breaking the complex down, illustrating with examples, and parsing the technical, Paul accomplishes the objective of educating and empowering. Together with his previous book on The Art of Cyber Risk Oversight, Cyber Risk Leadership is the basis of a foundation of knowledge for modern business. Paul Hearns Editor