CEOs Must Champion Corporate Cybersecurity

—Originally published on Chief Executive—

​It is time to re-examine the way that we think about and what we expect from organizations impacted by cybersecurity breaches. A frank conversation on the responsibilities of company leadership, for both the C-Suite and the board, is long overdue. An organization’s responsibilities around consumer privacy in many ways remain somewhat ambiguous. Only by creating and upholding a consistent standard can corporate America ready consumers for the risks inherent in 21st-century levels of connectivity.

First and foremost, this means speedily and publicly acknowledging a breach. While CEOs and their boards have a responsibility to seek out and follow legal advice in these circumstances, this advice may ultimately be at odds with the best interest of the public – and not being responsive to the risks and concerns of the public will ultimately wind up hurting you more. A protracted delay due to legal concerns or fear of bad press increases the likelihood of a larger breach, affecting even more accounts and individuals. It also jeopardizes a company’s reputation, which in turn impacts stockholders, members and users – not just top-level, C-suite executives or board members.

White Paper: Protect Your Employees from the New Dangerous Realities of Identity Theft

Once the breach is made public, leaders must do all they can to help those affected by the breach secure their information and get their lives back to normal. Here again, we can learn from Equifax: After the breach, in what seemed publicly like a good consumer protection move, the company offered free credit monitoring services but using their very own product. For those with a greater knowledge of how these things work, including the media, this move not only seemed insufficient – credit monitoring does nothing to restore the identities of affected individuals – it also seemed inappropriate. Equifax was asking consumers to once again provide them with personal information immediately following this major breach.

To be clear, there’s nothing wrong with credit monitoring if you understand what you’re getting, but most people think it’s protection against identity theft. It isn’t. Like the red light in your car that tells you that the engine is overheating, credit monitoring merely alerts you to a specific problem without fixing it. And credit monitoring doesn’t monitor the deep and dark web, which is where many cybersecurity threats are propagated.

Company leaders must also have a plan for how they are going to protect employees. More companies are considering identity protection as a benefit they can offer employees, and with good reason. Identity theft doesn’t only impact credit cards or checking accounts: It can tamper with criminal or medical records, endangering not only finances but your liberty and your life itself.

There are essentially nine different kinds of identity theft – financial, child, social security, driver’s license, criminal, employment, insurance, synthetic and medical identity theft – and if a bad actor identity theft gets hold of one of these kinds of information, it becomes easier to exploit all the others. By offering identity recovery services to employees and to users, companies can make dealing with a breach far easier when it does happen and demonstrate their dedication to worker well-being.

Lastly, in addition to providing an effective cybersecurity infrastructure, executives must ensure that their company security practices are up-to-date. Although there is no way to guarantee that a breach will not happen, companies can certainly decrease the risk by taking steps like training employees in effective password creation and usage, phishing detection, and requiring two-factor authentication across all devices. And, as Equifax learned, it is also essential to ensure that all customer-facing software is patched religiously, given that lax patching procedures can result in an open door for hackers.

Whatever you and your company ultimately decide to do, be sure to act – and act soon. It is vital that the industry as a whole make its commitment to protecting consumers clearly. After this week’s hearing, Congress will undoubtedly feel compelled to act on this issue, and as any CEO knows, heavy-handed policies can ultimately stymie, not only a company’s ability to respond to a cybersecurity threat but ultimately its growth. The extent to which congressional intervention is needed will be influenced by how thoroughly, thoughtfully and quickly industry engages with this issue.

And, political involvement aside, it is important for corporate leaders to step up as a matter of principle. Identity theft can wreak incredible havoc, decimating the finances and destroying the lives of families and companies alike. Doing the work now to protect our employees, stakeholders and clients show not only that we care about the company’s wellbeing, but that we are invested in them as individuals and want to set them up for security and success in the coming connected century.