Effective CISO Leadership - Doing the Right things Right - Pan Aslan American Business Council 2018

Sep 4, 2026

Effective CISO Leadership: Doing the Right things Right addresses cybersecurity leadership priorities by analyzing CISO concerns and breach trends. It highlights expectations for increasing stress, potential budget pressure, and risks such as job loss. The material presents incident patterns by industry and top breach types, then quantifies breach costs relative to averages. It consolidates cost-reduction levers and practical risk-mitigation actions across attack patterns, including incident response, encryption, training, DLP, analytics, BCM involvement, and board-level governance.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages36

Reading Time1 h 31 min

AccessFree to download

What is the Question?

Incident Patterns by Industry and Top Patterns for Breaches

Reducing Data Breach Costs

CISO Must Review Attack Patterns of How to Minimize Risk

Effective CISO Leadership:Doingthe Right things Right Todd Fitzgerald CISM,CISA,CRISC,CGEIT,CiSSP,CIPP/US/EU/CANADA,CIPM,PMPISO27001,ITILv3f Managing Director/CISO &Cybersecurity Leadership AuthorCISO Spotlight,LC Deerfield,1Lwww.cisospotlight.com Presented at Pan Aslan American Busine s Council NoV9,2018 Ch cago,L CISO SPOTLIGHT,LLCTrusted Cybersecurityand Privacy Training 67%of CISOs believe their organizations are more likely to fallvictim toia cyber attack or data breach in 2018Ponemon Institute;,“What CISOs Worry About in 2018” Resulting In.. 69%Anticipate Roles Will Be MoreStressful.... 63%Believe Information Security Budgetsto Decline or Remain Flat... 45%Even Fear Job Loss in the Event of A.. 9家非非郭书多 *8书8世书林55林本移5林路5本够s5电态车55555555s刺m55转特5551555韩5555555率5555=5章5=5串55李5幸5=氧554=幸p45幸5知M3幸幸 DATABREACH零常事事事本零事客和p移客本甚8甚88s5本书典 s本58林ss路5客世本5本5=+★=5率55s 5= # 因事5事5事本5s uS⁵5ee5韩韩5串5 55车5车韩5 5整事5幸5515章季===55李车555幸=55辑季韩 FRES PY庭Y 幸 # WHAT IS THE QUESTION? A。11 BILLION B。1.9 BILLION C.500 MILLION D.8,229 # INCIDENT PATTERNS BY INDUSTRY AND TOP PATTERNS FORBREACHES | Incidents by Industry (security events
compromising integrity,confidentiality or
availability of an information asset) | | | --- | --- | | Accommodation
Manufcturing
Professional
Information
Healthcare
Financial
Education
Public
Retail
Patterns | | | 2485988
294
26
57
154
49
19
21
Crimeware | | | 9
1
82
120
41
24
12
4
Cyber-Espionage | | | 104703
580
1
336
85
74
151
13
Denial of Service | | | Everything Else | 12
68
41
39
81
63
59
48
13 | | 37287
17
3
4
15
96
16
10
Lost/Stolen Assets | | | 1774
2
34
11
30
181
22
16
3
Miscellaneous Errors | | | 1
1
5
81
49
6
Pay Card Skimmers | | | 138
5
7
7
28
22
21
1031111
Privilege Misuses | | | 306
1
2
1
2
11
Point of Sale | | | 3497
73
17
11
88
277
36
29
Web Applications | | Shaded box=Top patterns accounting for breaches byindustry(confirmed disclosure to an unauthorized party) # REDUCING DATA BREACH COSTS Difference from mean (USS) -20 -15 -10 -5 0 5 10 15 20 25 Costs may be decreased orincreased from $141 per capitacost per customer recordEvaluate in terms of fixing theprocess vs the incident Incident Response TeamExtensive use of encryptionEmployee trainingBCM involvementParticipation in threat sharingUse of security analyticsExtensive use of DLPData classification schemaInsurance protectionCISO AppointedBoard-level involvementCPO AppointedProvision of ID protectionConsultants engagedRush to notifyLost or stolen devicesExtensive use of mobile platformsCompliance failuresExtensive cloud migration Third Party involvement16.9 CISO SPOTLIGHT,LLC Trusted Cybersecurity and Privacy Training # CISO MUST REVIEW ATTACK PATTERNS OF HOW TO MINIMIZE RISK | ATTACK PATTERN | ·HOW TO REDUCE RISK | | --- | --- | | Crimeware | ·Software updates,macro-enabled document risk | | Cyber-Espionage | ·Security Awareness training,phishing exercises | | Denial of Service | ·Test DDOS mitigation services | | Insider and Privilege Misuse | ·Limit,log,monitor use,large data transfer and usb awareness | | Miscellaneous Errors | ·Disposal processes,4-eye policy for publishing information | | Payment Card Skimmers | ·Train employees,monitor terminals with video,review tapes
regularly | | Physical Theft &Loss | ·Encrypt where possible,corporate policy limiting printing sensitive
data | | Web Application Attacks | ·Promote varying Pass

FAQs

What concerns do CISOs report facing in 2018?

The document summarizes survey findings that many CISOs expect higher likelihood of cyberattacks or data breaches, anticipate more stressful roles, and expect security budgets to decline or stay flat.

How does the document categorize breach incidents by industry and pattern?

It provides an “incidents by industry” breakdown alongside “top patterns for breaches,” grouping breach types such as crimeware, cyber-espionage, denial of service, insider and privilege misuse, and web application attacks.

Which measures are emphasized to reduce data breach costs and minimize risk?

It recommends evaluating cost changes by addressing process fixes versus the incident, and lists actions spanning incident response teams, encryption, employee training, BCM involvement, threat sharing, security analytics, DLP, data classification, and governance like board-level CISO involvement.

Sep 4, 2026

Uploaded by Clementine