Key Takeaways

• “To get the maximum impact, cybersecurity needs to take on a minimum effective mindset across business engagement, technology, and talent. Minimum effective is a deliberate, ROI-driven approach to leading cybersecurity into the future.”

• “A minimum effective mindset refers to the input, not the outcome.”

• “We in cybersecurity put maximum effort into everything we do, and that is sometimes killing us. Seventy-three percent of CISOs experienced burnout in the past 12 months, and if the boss is experiencing it, you know the department is feeling it.”

• Myth #1: More data equals better protection. “Instead of just more data, savvy cybersecurity shops pursue the least amount of information needed to help draw a straight line between the enterprise’s funding of cybersecurity and the amount of vulnerability that funding addresses.”

• Myth #2: More technology equals better protection. “This is based on another pervasive myth: the idea that just around the corner, some technology is coming to save us. This mindset causes us to buy and acquire solutions before we are quite sure how or whether there will truly be additive value.”  

• Myth #3: More cybersecurity pros equals better protection. “There is simply no way to scale our services to match the pace of the enterprise just by hiring more cybersecurity pros.”

• Myth #4: More controls equals better protection. “Employees report a huge amount of friction involved with secure behavior. Controls that are circumvented are worse than no controls at all.”

More information is available in the Gartner press release, “Gartner Identifies Four Myths Obscuring Cybersecurity’s Full Value.”

Key Takeaways

• “Stop mistaking security for privacy. Privacy allows purpose, leading us to assess what we need, every time and provides data usage lifecycle insight. Whereas, security just keeps what you have safe and doesn’t determine how personal data can be used.”

• “Purpose dictates what data should be processed, helped by context, and adds what can be expected and what can’t.”

• “Expectations are what individuals have of their own, aided by how we guide them along the way - a privacy user experience. Expectations shouldn’t be what they have come to expect after a bad experience.”

• “Take accountability for what you do with your customers’ data and take only what you need, anonymize where possible. If you can’t protect, don’t collect.”

• “In emerging digital environments, taking responsibility over the use of digital technologies, even if legally not required, builds and improves trust.”

• “Be empathetic by putting yourself in your customers’ shoes. Develop a sense of right and wrong that goes past just being afraid of punishment or hoping to generate a product sale whether legally or in terms of customer loyalty.”

• “Display competence by building the capacity and expertise to be able to quickly and adequately address problems. Don't simply acknowledge the need to care and accept the responsibility; you also need to be able to follow through.”

• “Promote trust. It is great to take responsibility, but if your stakeholders do not trust you to do so, your offer will not be accepted.”

Key Takeaways

• “Boards are willing to increase risks but want results. CEOs want ‘digital dividends’ and tangible growth from digital investments, while CIOs need to deliver outcomes by prioritizing the right digital initiatives.”

• “Digitization has accelerated enterprise demand for information security expertise, requiring CISOs to adopt a more rigorous approach to prioritizing security resources for their enterprise’s most urgent needs.”

• “With a seemingly unending list of projects, CISOs must ensure their teams are working on those that offer the greatest business impact.”

• “Technology deployments will continue to outpace your ability to secure them.”

• “Risk reduction efforts are perceived as providing value, but senior leaders are doubling down on digital investments and want measurable results.”

• “Security decisions cannot be made in isolation by the security team.”

• “Security and risk management leaders must decentralize accountability and expand their focus to improving cyber judgment across the enterprise to help decision makers make informed risk decisions without their direct involvement.”