Name: cybersecurity
Uploaded: 2014-10-24
Duration: 3 min 51 s
Description: cybersecurity

So we saw Target this year. It, it became so clear that it's a management problem because it's dangerous to management if you don't have this under control. What did we learn from the Target experience? And what should companies be doing internally with their management structures to combat this better? So I, I think just at the start I think. Cybersecurity can't be an IT issue alone, right? It's a business issue that has technology components to it, and I think that's really critical. I think, companies, if you don't have a CSO, you'd better get a CSO. And it's not just that, but it's having this deep, consistent investment, right? Both around protecting the perimeter, protecting your intellectual property, knowing what that is. And how to protect it. But also I think the, the target incident really highlighted the importance of not just the protection investment. But also of the incident response. Yeah. And how you communicate and kind of handle that as it's happening. So, how do you? I mean, what, what, what did they do wrong? And what should you do? Well, I, look, I think Like any big company, if you know what your risks are, you wanna practice around how you either prevent or, or respond in the, in the inevitable attack. And so having a communications plan, running tabletop exercises to really test that plan. Really getting sort of deeply engaged in the thought process around you know, who needs to be called when and how exactly would Mm- hm. would we manage a respon, a response if it happened I think is really critical. Right. Companies have crisis response plans. I think what, what Target demonstrated and [ COUGH ] and I, you know I don't have a lot of close contacts there, is that they didn't include cyber. Attack in their crisis response plans. And that's Really. Yeah, I, and I think that's common oversight. I mean, one of things FedEx learned it's the, from watching Target's responses, we begin drilling rather quickly about our cyber response portion of our plan. we're, we're an airline. We drill a lot on airline crises. We're in inter, a global shipper. We, we drill a lot of different incidents a lot. But not cyber. And no. So after the Target incident you added cyber to your drill. We already had cyber in there but we're just drilling it more. To make sure that we can be much. Much more timely in how we respond to our customers and our stakeholders. Mm- hm. I, I would say that what you said, absolutely right. The other part of it is, is, and you mentioned it, Jamie, in the fact that it's not just an IT issue. And you need to have your board involved as well. They need, it, it needs to be on your risk register that's reviewed by, y, your, your board. On a periodic basis to talk about. What are you doing? How are you doing it? How are, how do you make sure that you have the right capabilities in place? Do you need any other resource? So that should be the questions that your board is, is asking. The, the other thing I would say is, is that, everyone has a role. And so you need to make sure that you have, as you said, the, the plan with how you're going to communicate. How transparent will you be? What will you who will you call? Which customers wo, who, at what level, calls which customers? You have to have that all laid out because it happens in a se, in a flash. As well as your IT organization, your [ UNKNOWN ] organization, needs to have the agility to make the necessary changes when they see something happening, to shut something down, look, build something, do whatever they need to do. In the moment of the battle, and not have to go up through all layers of management to say, we need to do this. So they need to have that agility as well.