Dilbert's Pointy-Haired Boss & Influencing executive perspectives on Information Security

Question

In Scott Adam's cartoon Dilbert the Pointy-haired Boss has no name because Scott Adam's wanted his readers to relate the boss character to bosses known to the readers.

This is pointed out because (and unfortunately) many Information Security professionals all-to-often encounter naive attitudes from executive management similar to the ones Dilbert's pointy-haired-boss exhibits - such as:

We've had no cyber-security breaches in the last fiscal last year. Why do you suggest we need to spend more on cyber-security? Since there seems to be no threat, isn't there room to shift funds away from cyber-security?

This logic is like "The bank hasn't been robbed in years, therefore it doesn't need security guards!"

I've found at least 1 strategy works to influence attitudes like this: which is emphasizing the Return-On-Investment (ROI) mitigating risks is always less than that of accepting risk in the first place (i.e. "An ounce of prevention is worth a pound of cure!")

QUESTION:

Since it's clear all effective information security strategies starts with executive management "buy-in", what strategies have folks found to be effective in changing some of these naive attitudes held by senior management towards appreciating the true nature of these risk, and in cultivate a corresponding appetite for investing in risk-mitigation?

Answer 1

When it comes to business management, it always comes down to ROI. If you are not hitting them at that level, then you will likely lose.

So, when you talk about the "true nature" of the risk, what are you talking about, if not the ROI? It is your job to know the right answers and the best practices, but it is management's job to weigh all the factors, including impacts. Talk to them on that level, without being a 'chicken little'. Simply communicate.

So, keep doing what you are doing. Relate the risks to the impacts that management cares about. Then, if you have done your job and told them what they need to know, let management do their job and make the decisions about what to do about it.