RSA 2013: Talking to Your Board About Security

Comment | Print | RSS

• Login to Rate

Information security leaders from Fidelity, Liberty Mutual, and Manulife Financial shared their experiences and best-practices for presenting to your board of directors during a session at RSA Conference 2013 on February 26 in San Francisco.

The overarching message? Get yourself out in front of the board of directors before you're called to stand before it. "If you wait until you're summoned, you're behind the eight ball already," said Chauncey Holden, chief information security officer at Fidelity. Oswin Deally, senior director for enterprise information security operations at Liberty Mutual, noted that if you're called before your board because something security-related has caught their attention, they'll have already formed their opinions about it. Instead, he said, "You want to be able to help form that opinion."

John Schramm, VP and chief information risk officer for Manulife Financial, added that taking a proactive approach to educating your board members about security is key throughout the year, not only for quarterly meetings. "One of things we started to do is prepare brief memos on topics that had come up [in the media] like DDoS attacks," said Schram. "We started circulating those to board members for education purposes. Sometimes you get little bits of feedback to allow you to prepare for when you're presenting to the board."

Media attention about cybersecurity is one of the reasons that boards of directors tend to be more open to allotting precious meeting time to their information security officers. "I realized I started getting more emails from our CEO on information security related topics every time there was something in the press," said Schramm. Holden said he's invited to present an update to the board nearly every single quarter. "Boards are more aware than ever that they have a fiduciary responsibility, and they don't want to be called to the carpet on that," he said.

The security executives shared their insights on the worst things you can do when presenting to your board:

• Deally: Have a very technical conversation about the things you are doing.
• Schramm: Put up a really complex network diagram.
• Holden: Walk in without knowing the backgrounds of the people to whom you're presenting.

Chances are you'll only be given about 10 minutes to make your presentation. How do you do so in a way that makes sense, without talking down to a room of accomplished business people? "I start by putting the concepts that I want to convey on paper and revising them 15 to 20 times," said Schramm. "I get them down to point where they are summarized on a level that anyone will understand them. Then I go over them with my wife, who is a healthcare professional who doesn't know technology, and with other friends who aren't in tech."

Schramm said he learned this lesson the hard way. At one of his first board meetings, he said, he prepared a technically detailed presentation, only to have one of the board members ask: "When I get that mail in my inbox from someone in Africa about winning a lottery, is that spam?"

That's not to say you should underestimate the intelligence of your board; rather, speak to them in the business terms that they understand. According to Deally:

You can predict, based on something that could happen against your value chain, what the risk is to your company. Those are meaningful things to convey to people who are interested in making sure the business makes money. The way [the business] makes money is by making sure your company keep selling products, servicing customers, and keeping customers happy. It's applicable not just to an insurance company, it's applicable to any company.

Getting your internal stakeholders on board is key, noted Holden:

You have to sell. If you haven't coordinated ahead of time with your head of audit, your head of risk, your CFO [and] if they look at you sideways, roll their eyes, whatever their interaction might be during the board meeting, you lose off the bat. You have to make sure you've got a full story across the board that really makes sense before you go in.

Most importantly, never try to bluff your way through, said Schramm:

One auditor told me that when you're dealing with boards never answer a question if you don't know the answer. Just say, 'I don't know the answer to that question. I'll have to get back to you.' If you position something incorrectly you end up living with that.

Have you had the chance to present to your board? If so, tell us about your experiences in the comments field below. What do you think of the advice offered by Deally, Holden, and Schramm? Can it work for you? What other important factors should you keep in mind?

Related posts:

• Words to Never Use in the C-Suite
• Don't Do This in the Boardroom
• Can You Spot the CIO in the Boardroom?
• Poll: Playing the Markets
• The Final Straw of Corporate Actions Reporting