#42 Is Cybersecurity a Technology Risk or a Business Risk? with Mark Nicholls, CEO @Information Security Group

Cybernomics Radio

Mark Nicholls discusses how to integrate cybersecurity throughout the development lifecycle rather than treating it as an afterthought with pre-go-live penetration testing. He explains that embedding security into early design phases requires both leadership commitment and proper resource allocation to overcome the natural friction between IT and security teams.
• Moving security activities earlier in the development lifecycle is crucial for effectiveness
• DevSecOps implementation remains relatively rare, especially in larger legacy organizations
• Many security teams lack capacity to participate in early design stages
• Where a CISO reports indicates organizational security maturity
• Less mature companies have CISOs reporting to CIOs, treating security as just a tech issue
• More mature organizations position CISOs outside IT, reporting to CEO or board
• Business risk assessment should be the ultimate measure of security effectiveness
• Australia's "Essential Eight" provides practical baseline controls compared to NIST or ISO
• Regulatory requirements for breach reporting are increasing globally
You can find Mark Nicholls on LinkedIn or at informpros.com for any questions or follow-ups.
Josh's LinkedIn

Chapters

1. IT and Security Convergence (00:00:00)

2. Embedding Security in Development (00:09:03)

3. CISO Reporting Structure and Maturity (00:14:01)

4. Business Risk vs. Technical Risk (00:18:31)

5. Security Standards in Australia (00:23:10)

6. Regulatory Differences and Final Thoughts (00:25:42)