“Critical industries are up against never before seen challenges to remain secure and operational, while regulatory pressures have completely upended the role of the CISO in corporate America.”
Why this is important: (1) Single points of failure continue to proliferate critical IT systems - While 2024 had its fair share of high-profile IT systems failures, such as Change Healthcare’s ransomware attack and CrowdStrike’s faulty software update, cybersecurity experts forecast single points of failure will continue to be a problem in 2025. Many businesses fail to recognize single points of failure vulnerabilities or do not accurately gauge their potential impact, and are no match to these sophisticated and efficient systems-wide cyberattacks occurring regularly resulting in diminished customer confidence. Analysts urge businesses to stop singularly focusing on preventing cyberattacks, and realize that they need to accept and prepare for the inevitable – catastrophic failures can and will occur. That is why resilience-based thinking is recommended. Businesses will have the best chance to bounce back by anticipating and preparing for these intrusions in lieu of prevention considerations only.
(2) Regulatory environment, tense threat landscape create new landscape for CISOs - With malicious cyber activity on the rise, federal and state regulatory obligations and compliance have increased exponentially placing a heightened burden on Chief Information Security Officers (CISOs) and other top security executives. Regulatory officials seek to gain real-time intelligence and insight into cyber threats and to ensure prompt disclosure of risks and cyberattacks to key stakeholders. One cybersecurity company, Trellix, is considering splitting the role of the CISO to include a business CISO role in order to deal with the dramatic increase in state and federal regulations. According to National Cyber Director Harry Coker, Jr., efforts to streamline the regulatory burden on companies are underway so as to lessen the amount of time a CISO must spend in compliance versus the time being spent in defending against inevitable cyberattacks. In late 2023, the Securities and Exchange Commission (SEC) began enforcing rules requiring publicly traded companies to report material cyberattacks and breaches to the agency. It is reported that this resulted in a 60 percent increase in cyber disclosures to the SEC, though less than 10 percent of these disclosures were of a material nature. More than 75 percent of incident disclosures filed with the SEC were made within eight days of the actual incident, with 40 percent of companies making additional disclosures with Form 8-K.
(3) Telecom attacks will fester into 2025 - Federal cyber authorities were overwhelmed in 2024 with containing and determining the scope of a sweeping series of attacks on telecom networks in the United States, and this problem will persist in the new year. Salt Typhoon, a threat group sponsored by China’s government, is believed to have ongoing access to at least nine telecom companies in the United States after infiltrating these networks in 2024. These attacks on critical infrastructure in the United States are an attack on its citizens' cyber-interconnectivity, and the public remains vulnerable as this infiltration remains ongoing without an understanding as to the extent of what Salt Typhoon has done. Defenders have not been able to boot the attackers embedded in telecom networks. Federal authorities suspect espionage, while other possible motives include evolving communication disruption capabilities in times of crisis or conflict. Incredibly, there appears to be no end in sight as telecom networks remain vulnerable.
(4) Evolution of the CISO - In December 2023, the SEC rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure went into effect which places increased responsibilities on CISOs, particularly at publicly traded companies. The SEC ruling finds CISOs being held to a much higher standard in terms of reporting cybersecurity incidents and risks to stakeholders and to the SEC. With this increase in regulatory responsibilities, CISOs are also experiencing more prominent roles within the governance structure of modern companies and increased influence in the boardroom and C-suite, particularly with technology strategy. --- Jennifer A. Baker