4 things your CEO wants to hear about security breaches

Published | Thursday, October 18th, 2018

“Are we at risk?”

That’s a question that all of us IT professionals have heard at one time, whether you are an IT auditor, a security/compliance officer, or an IT ops manager.

It may come from your CIO, CTO, or even your CEO, but it’s always the same story: a security breach is making the news, and they want to know if your organization is exposed to that risk, or any others.

They expect YOU to have the answer. It’s that chilling moment when strategic risk meets daily reality.

So, what will you say? The answer is to own that moment and be a super star. Here is what you need to respond with:

  1. Yes, we are aware of this critical vulnerability.
  2. We know how many machines are vulnerable (if any) in our organization.
  3. The emergency patching has already started.
  4. Here is the progress so far.

How close are you to being a super star? Good news: ACL can help you get all the way there. Here’s how.


1. Yes, we are aware of this critical vulnerability.

You cannot get ahead of the problem if you depend on the same source of information as your CEO (e.g., the news cycle). The solution? Get your data directly from the source, such as the United States Computer Emergency Readiness Team (US-CERT). You could simply sign up to their weekly email summary of all new vulnerabilities, sorted by risk level. But this means relying on someone reading this email diligently and having enough knowledge about your architecture to identify which ones are relevant, not an ideal solution.

A better way is to automatically retrieve that data from the web. ACL Analytics offers many data connectors out of the box and can also connect to custom APIs. The result: a consolidated table with all the vulnerabilities information you need, instantly retrieved from US-CERT. And with ACL Analytics Exchange, you can schedule the import as often as you want: every week, every day, or every hour.


2. We know how many machines are vulnerable (if any) in our organization.

An average of 38 new vulnerabilities are identified every day. The challenge is that you don’t know in advance how many of these new security holes apply to your organization; it is likely that not all of those vulnerabilities will be relevant to your systems. But to be sure, you will need to cross-reference the list of vulnerabilities with your list of assets: for each vulnerability, check the full list of software installed across your organization. This easily results in hundreds of millions of comparisons to run!

Luckily, ACL has been a leader in data analysis for the past 30 years and can turn this daunting and seemingly impossible task into something that takes just minutes to handle:

  • Use ACL powerful text analysis and fuzzy-matching functions to match disparate data
  • Summarize the data to reduce the volume and accelerate treatment
  • Leverage previous findings to focus on what’s new and avoid duplicating efforts.

This is all handled by ACL Analytics and it runs automatically so that your team and your resources are freed to focus on where they can really add value.


3. The emergency patching has already started.

Do you remember Wannacry? This ransomware exploited a security hole in Windows with devastating consequences. Depending on the size of your organization, thousands of machines may need an update from this one vulnerability. But often, the logistics of patching is reduced to a single individual grinding through a spreadsheet listing all the vulnerable systems, possibly reaching out to employees via email or phone.

How can THIS be the best system? Hint: it’s not.

Instead, build your own customized workflow in ACL GRC Results. Reliable, consistent patching is just a few clicks away, with a process that includes:

  • Questionnaires sent automatically whenever an action needs to be taken
  • Triggers to react to new data and notify the appropriate group(s)
  • Metrics to receive alerts when certain thresholds are crossed.


4. Here is the progress so far.

Providing visibility into your process is the key to building trust with your executive team. Unfortunately, providing a progress update is often a painful ad-hoc process, especially if you’re tracking everything in a spreadsheet. This comes with a number of challenges.

Challenge #1: The data is not up-to-date.
A spreadsheet is merely a tracking mechanism, disconnected from the actual work because:

  • It doesn’t include everything that’s happening (e.g., email conversations)
  • It’s not easy to collaborate with multiple people in parallel
  • Someone needs to remember to look at it.

Challenge #2: It’s time consuming.
It takes time to transform your data into meaningful insights. It may take even more time to make it presentable and visually engaging. And it’s disconnected from the ongoing strategic risk management, which means you’ll need to duplicate your work in separate systems.

Challenge #3: The report is out-of-date.
By the time you obtain a snapshot of the situation and produce a report, it’s usually out of sync with reality. It won’t show ongoing progress, and you will need to repeatedly recreate it. This is where ACL’s magic shines through, because all of the pieces are working together. With all your data in one place, ACL Storyboard lets you tell your story your way by:

  • Visually representing the data in real time, effortlessly
  • Adding context to help your audience get the message
  • Sharing the story with anyone who has internet access.

No organization wants to face the unavoidable risks of security breaches and the consequences of being unprepared can be far-reaching. But as this blog indicates, with expert software such as the ACL Platform, it’s not only possible to better respond to them when they do occur, but to also more easily and adequately address the inevitable “Are we at risk?” question when it comes from senior executives.

  Get in touch with us!

In compliance with Section 45 of the ECT Act please confirm the following:

I would like to receive future communication from CQS.

Leave a Comment

Your email address will not be published. Required fields are marked *