Kate Goldman
A Cascade of Avoidable Errors: The Microsoft Breach & Human Risk in Modern Security Practice
Key Considerations for CISO’s in the wake of the CRSB’s Report on the MSFT Breach As we all know, the need for cybersecurity is still on the rise,...
It’s never been quite so clear. Recent high-profile breaches and regulatory responses have amplified the urgent need for organizations to address and prioritize the human layer in cybersecurity risk management.
The unfolding narrative, including the Cyber Safety Review Board's report on the Microsoft breach, for the first time clearly calls out and underlines in bright red marker how lapses in security culture directly contributed to significant vulnerabilities. The SEC has also introduced stringent regulations that mandate transparency and proactive risk management, emphasizing that companies must disclose material cybersecurity incidents and their risk management strategies.
What do these new signals mean? Let’s read the tea leaves on an important change of focus. These regulatory changes reflect a broader understanding that the resilience of a company's cybersecurity is fundamentally tied to its security culture. This prompts a critical question every organization must now address: How secure and resilient is your company, and what role does your security culture play in safeguarding its future?
Increasing Scrutiny on Cybersecurity Practices: The SEC and other bodies have increased scrutiny on how companies manage and disclose cybersecurity risks. This includes a push for companies to not only report incidents more transparently but also to demonstrate how they integrate cybersecurity risk management into their overall business strategies. The focus is not just on responding to incidents but also on preventing them through better governance and a strong security culture.
Implications for Corporate Strategy: The emphasis on cybersecurity disclosures is likely to influence corporate strategy significantly. Companies must now establish robust cybersecurity risk management strategies that are subject to regulatory audits. This is expected to improve cybersecurity practices but also places a greater burden on companies to manage their reputations and legal risks effectively.
The Rise of Regulatory Scrutiny
The SEC’s newly adopted rules on cybersecurity risk management, strategy, and governance reflect a significant move towards greater scrutiny. That’s not news to most people who are in or follow the industry. However, these new signals and rules have many more downstream effects that most realize. These regulations mandate that companies disclose material cybersecurity incidents and detail their risk management strategies. And that isn’t just your seven layers of OSI- cyber risk management covers every aspect of our modern work.
This regulatory shift aims to foster a culture where cybersecurity is woven into the fabric of corporate governance, emphasizing the need for companies to be proactive rather than reactive in their cybersecurity efforts. The rules underscore the importance of transparency in disclosing cybersecurity practices and incidents, aligning investor and public expectations with the reality of cyber threats.
Impact of Major Breaches on Regulatory Trends
Recent major breaches, such as those at Microsoft, UnitedHealth, and SolarWinds, have not only highlighted vulnerabilities but also catalyzed regulatory and governmental responses. These incidents illustrate critical failures in managing human risk and the necessity for a cultural overhaul in cybersecurity practices within organizations. The Cyber Safety Review Board's critiques, for instance, have pointed to "preventable errors" and inadequate security cultures that significantly contributed to the breaches. In response, there is a growing demand from cyber insurers and regulatory bodies for more rigorous risk management and quantification strategies.
Increase of Regulatory and Government Scrutiny
Across the breaches, there's a strong call from government entities for increased transparency and accountability in cybersecurity practices. For instance, the Cyber Safety Review Board (CSRB) criticized Microsoft for a series of avoidable errors that indicated an inadequate security culture which required a major overhaul, emphasizing that such incidents were preventable and should never have occurred.
Here’s a quick overview of some of the recent changes:
Common Themes in Regulatory Responses:
- Emphasis on Culture Change: In response to these breaches, there is a recurring theme that organizations need to shift from compliance-focused security cultures to ones that prioritize continuous improvement and transparency in cybersecurity practices. This includes public commitments to security improvements and regular updates on progress.
- Proactive vs. Reactive Security: Regulatory bodies are pushing for a move from reactive security measures to a more proactive approach. This involves not just fixing problems as they arise but embedding robust security practices into the daily operations and decision-making processes within organizations.
- Increased Accountability: There is a clear trend towards holding senior leadership directly accountable for cybersecurity. For example, following the CSRB's findings, there's a recommendation for Microsoft’s leadership to prioritize security enhancements and to develop clear, actionable plans for security-focused reforms.
Specific Regulatory Actions and Guidance:
- Executive and Legislative Actions: This includes Executive Order 14028 aimed at improving the nation's cybersecurity and Critical Infrastructure Order 13636, which push for enhanced cybersecurity across critical infrastructure sectors.
- Regulatory Guidance and Scrutiny: Various departments and agencies, including the SEC, FTC, and the Department of Justice, are intensifying their focus on how companies manage cybersecurity risks, with specific emphasis on pre-incident risk management practices and the robustness of incident response and reporting mechanisms.
Cybersecurity and Digital Risk Management:
- Human Element and Workforce Security: Insights from these incidents and regulatory responses underscore the importance of addressing the human elements of cybersecurity. This includes enhancing security training, fostering a security-aware culture, and understanding the psychological and behavioral factors that influence security practices.
- Data Protection and Privacy: A recurring theme in regulatory scrutiny is the importance of prioritizing data protection and privacy within cybersecurity strategies. This involves not only adhering to legal standards such as HIPAA for healthcare data but also embedding privacy considerations into the design and operation of IT systems.
To synthesize these insights into actionable strategies, CISOs and C-suite executives should focus on developing cybersecurity programs that are not only technically robust but also integrate strong human element considerations, promote a proactive security culture, ensure transparency and accountability, and adhere to evolving regulatory expectations. This holistic approach will be more effective and sustainable in mitigating cyber risks and aligning with regulatory expectations.
Connecting Human Risk and Proactive Security
The link between human error and cybersecurity failures is well-established. The emphasis now is on understanding human behavior as a critical component of cybersecurity risk management, on a level never before possible. Integrating behavioral sciences into cybersecurity strategies is a critical component to detect and identify potential human errors across a wide range of information and data practices, ideally before they lead to security breaches. This proactive approach involves embedding the right values into your organizational culture, the ‘way we do things here’ should prioritize continuous learning and adaptation to evolving cyber threats. That is the nuclear core of being a resilient and secure organization.
Increasing Accountability For Senior Management & The Board
With the new regulatory frameworks, the input from organizations such as NACD and increasing pressure from cyber insurance, the accountability of senior management and boards in overseeing cybersecurity risks is front and center. Organizations are increasingly required to develop comprehensive cybersecurity strategies that are regularly reviewed and updated by the board, ensuring that these strategies are aligned with overall business objectives and risk management frameworks. This strategic oversight is crucial in building resilience against cyber threats and ensuring that cybersecurity measures are effective and responsive to the dynamic nature of risks.
However, when scanning all the digital risks and cyber threats to assess, ‘are we doing enough’ ‘are we covered’ and “can we recover’ the focus must shift from purely technical and technology stack driven audited to strategies that encompass the human elements of cybersecurity as well.
Practical Steps Towards Including HRM in Comprehensive Cyber Risk Management
1. Examine Human Risk Management Maturity: Organizations must assess the maturity of their human risk management strategies. This involves evaluating how well human behaviors and risks are integrated into the overall cybersecurity strategy.
2. Assurance to the Board and C-Suite: It is essential for cybersecurity leaders to provide assurance to the board and C-suite that the organization not only has effective tools but also a robust program strategy that addresses the human elements of cybersecurity.
3. Collaboration and Partnerships: Working with partners who specialize in behavioral sciences can accelerate the integration of these disciplines into cybersecurity practices. Such collaborations can enhance the organization’s capability to manage human risks effectively.
4. Budgeting and Strategic Planning: With budget constraints often cited as a significant barrier to improving cybersecurity practices, it is crucial for leaders to get ahead of the funding cycle. Developing a business case that clearly outlines the benefits of investing in advanced human risk management strategies is essential for securing the necessary resources.
Fostering a proactive security culture and enhancing strategic oversight, organizations can significantly strengthen their defenses against cyber threats. This strategic shift is not just a regulatory requirement but a business imperative that can safeguard the organization’s future in an increasingly interconnected world.
As we navigate the complexities of the digital age, the focus must shift from purely technical solutions to strategies that encompass the human elements of cybersecurity.
More from the Trenches!
The Current Landscape of Cyber Risk Management
In the quickly evolving world of cyber risk management, many organizations find themselves tethered to outdated methods. Often constrained by budget...
5 min read
Cybersecurity as a Strategic Business Imperative: What you need to know about CISA’s 2026 Roadmap
In a world increasingly defined by digital interactions, the unveiling of the US Cybersecurity and Infrastructure Security Agency's (CISA)...
5 min read