How to convince the board to invest in security

At Infosecurity Middle East, the regional edition of Infosecurity Europe, Mimecast’s regional manager, sales engineering for the MEA markets Brian Pinnock says the biggest challenge when it comes to cybersecurity is IT departments’ difficulty in explaining the importance of security solutions to board-level executives.

“They still have this mistaken belief that protecting email is not important. Unfortunately, this continues to be the mindset even today. People think the cost of implementing a solution is quite high but they are not weighing it against the potential risks,” says Pinnock. “I believe the IT department can do a better job in communicating the significance of such solutions. They need to talk in a language that C-level executives understand instantly. IT tends to view the risk analysis in relation to breaches but what is required here is that they need to speak in business terms.”

According to Pinnock, IT heads need to talk about potential loss of shareholder value if the firm is exposed in a data breach or loss of business operations or any other financial ramifications.

“They cannot speak in vague terms, it needs to be quantifiable for C-level executives to truly understand the risks. However in order to do this, IT heads need to have data from organisations that have been affected and how much losses they have suffered because of a breach. But this is easier said than done, as companies don’t reveal the complete impact of damage during a breach.”

Mimecast’s focus at the event is to highlight its solutions and launch a “vision for cyber resilience for email.

“One of the misnomers of email is that customers believe they are simply protecting just their email software. However, cybercriminals use email as the number one system for an entry point into an organisation. By protecting your email, you are essentially protecting your whole organisation.”