CyberSecurity Institute

In all cases, good communication was the critical ingredient for success and resulted in the necessary funding, over a period of years, to establish and maintain a workable security program. To start the budget discussion, you must stress cost avoidance rather than profits and you will need hard, empirical evidence to depict the business risks and associated costs. Therefore, the best way to approach senior management to fund your cybersecurity program is to cast the expenditures using an ROI approach.

1. Set the foundation for security funding before you need it; and once established, keep it strong.
2. Don’t use scare tactics.

3. Establish your cybersecurity credentials within your organization.

4. Relate your security risks to the business.

5. Outline the need in plain English.

6. Develop a plan that meets the security needs but also considers financial constraints.

7. Once you get the funding, follow the plan you outlined.

8. Provide constant feedback on the security program.

9. Use outside resources to support your request.

10.Always emphasize that cyber security is not an “information technology” issue — it is an organizational risk management issue.

Link: http://www.csoonline.com/article/732053/10-tips-to-secure-funding-for-a-security-program?source=CSONLE_nlt_update_2013-04-21

For this reason, it is helpful to consider your role as a crisis manager in the face of a real event, such as the sudden, widespread internet interruption recently experienced across the island of Taiwan.

Though the blaze was contained quickly, this localized event caused a major national disruption. 80 percent of Internet services across Taiwan were impacted by what the Taipei Times indicates may have been the worst interruption for Taiwanese Internet users since the 921 earthquake of 1999.

Several lessons can be learned from this event about successful crisis leadership, not the least of which is that as a crisis manager, you always need to be ready for new categories of emergency. In a global economy where business operations are increasingly supported by cloud-based infrastructure, a small fire at one data center was able to impact the Internet services of most of a nation of over twenty-three million.

As a crisis manager, both before and during the event, you must consider the questions this emergency raises: What is the impact for your organization of a widespread Internet outage?

Ensuring that your IT framework and communications lines are sustainable is a key part of your role as crisis manager, and will enable you to operationalize your business continuity plans seamlessly if an event does occur?

It is also important that while planning a business continuity strategy, you establish an overarching vision of your crisis management that can be expressed in the details of your plan.

Prepare checklists of immediate action items for each type of event, and when doing so, look to a business continuity planning software platform that will allow you to streamline and automate these responses.

If testing reveals, for instance, that an emergency at one of your locations, such as a data center complex, or a network operations center, can bring your entire operation to a halt, you will have time to rethink your plans.

Even if you are executing your business continuity plan and your secondary data center is up and running, you need to know the questions to ask, both to make sure the plan runs smoothly, and to ensure you have a complete understanding of the situation.

It is likely that your initial information will be skewed or false in some way, so be prepared to revise your response one or two times in the initial moments of an emergency.

By writing during a crisis and logging all your actions, you will not only increase your clarity, focus, and decision making skills, but you will also have a record of your actions on hand for review after the incident is resolved.

Link: http://www.continuitycentral.com/feature1065.html