Quotes from cyber leaders

Teams that say their cyber-security is really good are the ones to worry about. — Teams that say their cyber-security is really good are the ones to worry about. After our breach, the most difficult issue was deciding when it was safe enough to come back online.
I learned that really smart engineers can talk English, under extreme pressure.
Dame Dido Harding, former CEO of TalkTalk, presenting on 4th June 2018

“They get pummeled by hackers because their cyber security is being managed by "Participation Trophy" winning wimps!" — “They get pummeled by hackers because their cyber security is being managed by "Participation Trophy" winning wimps!" ― James Scott, 2017 – Senior Fellow, Institute for Critical Infrastructure Technology

“Companies that are leveraging technologies the best, leveraging the best practices in order to mitigate their risk, they should see that reflected in the terms and conditions that they are offered by the market,” Noel Pearman of XL Catlin — “Companies that are leveraging technologies the best, leveraging the best practices in order to mitigate their risk, they should see that reflected in the terms and conditions that they are offered by the market,” Noel Pearman of XL Catlin The Royal Gazette - 15th September 2017

“Until you have experienced something like this, you don’t realise just what can happen, just how serious it can be.”
"I had no intuitive idea on how to move forward.”
Maersk CEO Soren Skou on how to survive a cyber attack - Financial Times, 14th August 2017

"Companies spend millions of dollars on firewalls, encryption and secure access devices, and it's money wasted; none of these measures address the weakest link in the security chain." — "Companies spend millions of dollars on firewalls, encryption and secure access devices, and it's money wasted; none of these measures address the weakest link in the security chain." – Kevin Mitnick, "The World's Most Famous Hacker" – Fix Global 18th April 2017

My message for companies that think they haven’t been attacked is: “You’re not looking hard enough”. — My message for companies that think they haven’t been attacked is: “You’re not looking hard enough”. James Snook, deputy director in the office for cyber security, Government cabinet office, London - April 2016

Even where the individual cannot take action following the exposure of their personal data, we deem there is a right to know per se which deserves protection — Even where the individual cannot take action following the exposure of their personal data, we deem there is a right to know per se which deserves protection Helge Veum, Datatilsynet (Norwegian data protection authority), Oslo - April 2016

The knock on effect of a data breach can be devastating. When customers start taking their business elsewhere, that can be a real body blow. — The knock on effect of a data breach can be devastating. When customers start taking their business elsewhere, that can be a real body blow. Christopher Graham, Information Commissioner of United Kingdom - January 2016

I’ve been through stages of denial, disbelief, frustration. A couple individuals displayed incredibly poor judgment and incompetence. — I’ve been through stages of denial, disbelief, frustration. A couple individuals displayed incredibly poor judgment and incompetence. Robert Pera, billionaire, on phishing loss of $46.7m that his staff didn't tell him about - January 2016

In the very near future, cybersecurity exercises are going to be absolutely expected of all companies by regulators — In the very near future, cybersecurity exercises are going to be absolutely expected of all companies by regulators Michael Vatis, founding Director of the FBI's National Infrastructure Protection Center - NYC, USA - January 2016

In defending a breached organization, I absolutely would prefer one that has done an annual incident response exercise — In defending a breached organization, I absolutely would prefer one that has done an annual incident response exercise Lori Nugent, Shareholder, Privacy & Data Security, at Greenberg Traurig - Chicago USA - January 2016

Companies should be thinking about the legal and managerial decisions that the CEO, the COO and the board will need to make in that kind of crisis situation. — Companies should be thinking about the legal and managerial decisions that the CEO, the COO and the board will need to make in that kind of crisis situation. Michael Vatis, founding Director of the FBI's National Infrastructure Protection Center - NYC, USA - January 2016

What types and number of cyber incidents do we detect in a normal week? What is the threshold for notifying our executive leadership? — What types and number of cyber incidents do we detect in a normal week? What is the threshold for notifying our executive leadership? George Grachis, Senior Consultant, Maxis360 - Florida USA - January 2016

The typical cyber-criminal is rather like your common thief: he will go for the window without security locks. There is a high element of opportunism. — The typical cyber-criminal is rather like your common thief: he will go for the window without security locks. There is a high element of opportunism. Thomas Naylor - Director - enablement.tech - London, UK - December 2015

Incident Response plans that are 30, 40 or 100 pages long may have their place. But a shorter document helps not only during an incident, but also before it, raising awareness with the senior leadership about the types of decisions they’re going to be asked to make. — Incident Response plans that are 30, 40 or 100 pages long may have their place. But a shorter document helps not only during an incident, but also before it, raising awareness with the senior leadership about the types of decisions they’re going to be asked to make. Liisa Thomas, Chair of the data security practice at Winston & Strawn LLP - 11th November 2015

JP Morgan is a company that has 2,000 people dedicated to cyber security. They have spent $250 million dedicated to cyber security. They did everything right, and they still got hacked — JP Morgan is a company that has 2,000 people dedicated to cyber security. They have spent $250 million dedicated to cyber security. They did everything right, and they still got hacked Erik Avakian, Chief Information Security Officer, Commonwealth of Pennsylvania, USA - Sept 2015

Any CEO who really understands risk knows that cyber is possibly the most unpredictable risk there is. It’s more unpredictable than a flood or tornado — Any CEO who really understands risk knows that cyber is possibly the most unpredictable risk there is. It’s more unpredictable than a flood or tornado Malcolm Marshall, KPMG’s Global Head of Cyber Security - UK - July 2015.

You would never dream of a CFO not coming to a board meeting. In addition, you would never see a CFO passing up using external audit or teams of external advisors. The same diligence has to be assigned to cybersecurity — You would never dream of a CFO not coming to a board meeting. In addition, you would never see a CFO passing up using external audit or teams of external advisors. The same diligence has to be assigned to cybersecurity Val Rahmani, Non-Executive Director, Aberdeen Asset Management, USA - April 2015

Key stakeholders often underestimate how complex and overwhelming it can be to manage all the ancillary people and groups who must play a role in mitigating a major breach incident, including internal and external attorneys, internal and external investigators, law enforcement, regulators, insurers and many others — Key stakeholders often underestimate how complex and overwhelming it can be to manage all the ancillary people and groups who must play a role in mitigating a major breach incident, including internal and external attorneys, internal and external investigators, law enforcement, regulators, insurers and many others Bryan Sartin - Managing Director - Data breach response and forensics - Verizon - April 2015

Investors see data breaches as a threat to a company’s material value and feel discouraged in investing in a business that has had its sensitive information compromised — Investors see data breaches as a threat to a company’s material value and feel discouraged in investing in a business that has had its sensitive information compromised Malcolm Marshall, KPMG’s Global Head of Cyber Security - UK - April 2015

Credit monitoring services only give consumers limited help, with a very small percentage of the crimes that can be inflicted on them. These are basically PR vehicles for most of the breached companies who offer credit report monitoring. — Credit monitoring services only give consumers limited help, with a very small percentage of the crimes that can be inflicted on them. These are basically PR vehicles for most of the breached companies who offer credit report monitoring. Avivah Litan, Vice President with Gartner Inc, Washington DC, USA - March 2014

"If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology." — "If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology." – Bruce Schneier 1996 in ”Applied Cryptography 2nd edition"

Membership gives unlimited access to the Cyber Rescue curated library of expert advice on cyber attacks, including:

Attack maps, showing live reports of current cyber attacks worldwide
Threat analysis, explaining the type and implications of various attacks
Cost calculators, to help organisations estimate potential damages
Response guides, including academic and government advice
Individual guidance for consumers and employees of breached organisations