Regulating cybersecurity, and data protection in general, is driven by two needs; to clearly explain the expectations that society has for the organisations that society is increasingly dependent on, to provide a mechanism for the unmanaged externalities to those organisations (the societal and personal harm from breaches) to be realised…
Tag: regulation
Cyber Resilience: Part Six Recommended Reading
Here are the sources used when developing the thinking behind this blog series:
Cyber Resilience: Part Five What next?
Cyber resistance clearly requires leadership and operational intervention from specialised cyber professionals. However, Cyber Resilience requires a broader institutional response that encompasses all aspects of the business. As such, it needs to be owned by the entire executive management of an organisation. “The Department encourages all institutions to view cyber…
Cyber Resilience: Part Four Companies’ Plans Must Include Both Resistance and Resilience
Resistance to cyber attack is undoubtedly valuable and can produce effective outcomes. However, resistance is expensive and there is a law of diminishing returns on the investments made in resistance, Moreover, because the preparations and mitigations employed in resisting attacks are often specific to particular, point-in-time threats, ongoing resistance is…
Cyber Resilience: Part One Introduction
This blog series is a re-tooling of a white paper I drafted in May 2015 while working at Stroz Friedberg. I want to thank Stroz Friedberg for the support and time to develop these ideas and specifically want to thank Bill Trent and Simon Viney from Stroz Friedbergs London office for…