Secure CEO As A Service: What It Is And Why CEOs Need It with OMVAPT Founder Krishna Gupta

In this interview series by Website Planet, I talk to executives from the best digital companies, who share their stories, tips and perspectives on what it really takes to create a successful website and online business.

A deep dive into decades of hands-on experience and technical expertise to learn untold truths and practical advice that will immediately help you build and grow your website.

Krishna Gupta has 22+ years of experience working with Fortune 100 companies, Small and Medium Enterprises, Startups, and Defence Verticals. Drawing from that experience he founded OMVAPT, where he offers his signature ‘Secure CEO as a Service’.

You’ve pioneered the concept of ‘Secure CEO as a Service.’ Could you explain what it means and why it’s crucial?

‘Secure CEO as a Service’ solves the problem of speaking to an information security expert and business leader on a paid hourly basis so they can build a cyber-resilient organisation right from the start.

It’s a system to build a startup from the ground up with security in mind at every level that enables startups, small and medium businesses, and medium enterprises to build a cyber-resilient organization. I provide the cyber security strategies, and then my team follows a thorough implementation process to find security gaps and fix the security risks whenever required.

What skills or attributes does a CEO need to get the best out of this service?

Implementing the ‘Secure CEO as a Service’ solution is always a top-down approach, completely customized for each business and the target market it is focused on at any given time. For instance, if the company is not in the EU but its target market is Europe, it must comply with GDPR. VAPT is mandatory for GDPR, although it is never explicitly stated anywhere.

It’s crucial for those open to feedback and willing to challenge the status quo. IT teams often need assistance in identifying security gaps, so an unbiased assessment of security risks and vulnerabilities is recommended. Establishing a separate Strategic Business Unit (SBU) for information security is essential.

Collaborating and solving problems using diverse perspectives from various subject matter experts, including outsourced vendors, is incredibly valuable because even the best cybersecurity experts can only reduce cyber risks to a certain extent but can never eliminate them entirely. Just as having doctors in a city doesn’t guarantee that all diseases can be cured and everyone will be 100% healthy.

What have been the most surprising challenges you’ve encountered when implementing SCaaS with clients?

Startups usually ignore security unless they receive/raise funds.
Bootstrapped startups only pay attention to information security if their clients ask about their security posture.
The rest of the companies ignore it until a security incident or security breach in their organization or the software/hardware supply chain.

What are the immediate Dos and Don’ts that you recommend for CEOs who want to take their first steps toward a more security-driven approach?

Before diving into the specifics, it’s essential to have a basic understanding of some cybersecurity concepts.

Here are some key terms you should be familiar with:

Cybersecurity: The practice of protecting computer systems, networks, and data from unauthorized access, use, disclosure, disruption, modification, or destruction.
Threat: A potential danger to an information asset.
Vulnerability: A weakness in a system that a threat can exploit.
Risk: A threat will likely exploit a vulnerability and cause harm.

Where to start

Conduct a Risk Assessment: The first step to improving cybersecurity is understanding your organization’s risks. Conduct a thorough risk assessment to identify your most critical assets and the threats that could impact them.
Perform a Vulnerability Assessment and Penetration Testing (VAPT): Ensure the unbiased VAPT report is available to assess the entire organisation’s security posture.
Always keep a separate Information Security Strategic Business Unit (SBU) where they perform Risk Assessment, VAPT, Malware Analysis, Cyber Forensics, Reverse Engineering, and all Offensive Security solutions. Either outsource proactively depending on the organisation’s or the client’s requirements.
Implement Basic Security Measures: Even if you’re just starting, you can immediately implement some basic security measures. These include: Strong passwords: Encourage employees to use unique passwords for all accounts.

Regular patching: Keep your software and operating systems up-to-date with the latest security patches.
Employee training: Educate your employees about cybersecurity best practices, including recognising and avoiding phishing scams. Network segmentation: Divide your network into smaller segments to limit the spread of malware.

Appoint a Cybersecurity Champion: Designate a senior executive responsible for cybersecurity. This person will oversee the development and implementation of your organization’s cybersecurity strategy.
Subscribe to OMVAPT’s ‘Secure CEO as a Service’ to ensure all stakeholders know your company’s information security and classification levels. Our service is designed for C-Suite executives to provide a Cyber-Resilient organization built from the ground up.
Consider Outsourcing: If you need the in-house expertise or resources to manage your cybersecurity, consider outsourcing to a reputable security provider.
Engage with Industry Experts: Network with other CEOs and cybersecurity professionals to learn from their experiences and best practices.

Mistakes to avoid

Ignoring the Problem: Cybersecurity is not something you can afford to ignore. The risks are too significant, and the consequences can be devastating.
Assuming You’re Not a Target: Even small businesses can be targets of cyberattacks. Don’t assume that you’re too small or insignificant to be a target.
Cutting Corners on Security: Investing in cybersecurity is an investment in your business. Take your time with security measures, as this could lead to costly mistakes in the long run.
Blaming Employees for Breaches: While employees can play a role in preventing breaches, it’s important to remember that no security system is perfect. Don’t blame employees for violations that occur. Instead, C-Suite leaders should educate various business units, vendors, investors, and all stakeholders on a proper cybersecurity awareness training program.
Ignoring Regulatory Requirements: If your organisation is subject to industry-specific regulations, such as GDPR or HIPAA, it’s essential to comply with these requirements. Failure to do so can result in severe penalties.

You can build a stronger foundation once you have taken the initial steps to improve your cybersecurity. Here are some additional recommendations:

Develop a Cybersecurity Strategy: A well-crafted cybersecurity strategy will guide your organisation’s efforts and help you prioritise your investments.
Invest in Cybersecurity Training: Provide ongoing training to your employees to keep them up-to-date on the latest cybersecurity threats and best practices.
Implement a Security Information and Event Management (SIEM) Solution: An SIEM can help detect and respond to security incidents. Consider a Cybersecurity Framework: A framework like the NIST or ISO 27001 can provide a structured approach to managing your cybersecurity risks.
Conduct Regular Security Audits: Regular audits can help identify vulnerabilities and ensure adequate security measures.

Remember!
Cybersecurity is complex, but it’s essential for your business’s long-term success. Following the advice in this article, you can take the first steps towards a more security-driven approach. Cybersecurity is ongoing; staying informed about the latest threats and best practices is essential.

From your experience, how should CEOs communicate the importance of cybersecurity to their board to get approval for necessary investments?

We speak with decision-makers and decision influencers, so establishing trust and speaking their language is necessary when we present a VAPT report. Keep these differences in mind:

IT Teams or developers are only interested in gaining technical know-how to fix the security vulnerabilities.
CIO, CISO, CSO, and CRO are only interested in knowing the number of high-severity vulnerabilities, when they were fixed when they need to be fixed as a high priority, and what support they need to provide their team so they can meet their expectations.
In smaller organisations, only a few C-Level Executives are present, usually the Founder or CEO themselves.

Understanding their background or experience and then communicating in a way that makes them understand the need for proactively securing their organization is crucial.

What regulatory changes, trends, and emerging technologies will change how executives approach cybersecurity over the next few years? How do you suggest them to get ready?

Regulatory compliance has always been a cornerstone of effective cybersecurity. However, the regulatory landscape is evolving rapidly, with new laws and standards being introduced to address emerging threats and protect consumer data. C-level executives must stay informed about regulatory developments to avoid costly penalties and reputational damage.

General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA)

These landmark data privacy laws have significantly impacted organisations worldwide. C-Suite executives must ensure their organisations comply with these regulations by implementing robust data protection measures, appointing data protection officers, and conducting regular risk assessments.

Cybersecurity Maturity Model Certification (CMMC)

CMMC is gaining traction in the defence industry and beyond as a framework for assessing and improving cybersecurity capabilities. Organisations seeking to do business with the U.S. Department of Defense may need to achieve a specific CMMC level.

Industry-Specific Regulations

Various industries have unique cybersecurity regulations. For example, the Health Insurance Portability and Accountability Act (HIPAA) applies to healthcare organisations, while the Gramm-Leach-Bliley Act (GLBA) governs financial institutions. C-suite executives must understand the specific regulations that apply to their industry and implement appropriate compliance measures.

In addition to regulatory changes, C-level executives must be aware of the emerging trends shaping the cybersecurity landscape:

Cloud Security: As organisations increasingly adopt cloud-based solutions, cloud security has become a top priority. C-Suite executives must ensure that their cloud providers have adequate security measures and that their data is protected from unauthorised access.

Internet of Things (IoT) Security: The proliferation of IoT devices has introduced new security challenges. C-Suite executives must implement

robust security measures to protect their IoT devices and networks from cyberattacks.

Artificial Intelligence (AI) and Machine Learning (ML): AI and ML can enhance cybersecurity by automating threat detection and response. However, these technologies also introduce new risks. C-suite executives must carefully evaluate the benefits and risks of using AI and ML for cybersecurity.

Supply Chain Security: The increasing complexity of supply chains has made them vulnerable targets for cyberattacks. C-Suite executives must assess the security risks associated with their supply chains and implement measures to protect their organisations from supply chain attacks.

Zero-Trust Architecture: This security model assumes no one inside or outside the network can be trusted. By enforcing strict access controls and continuous authentication, zero-trust can help organisations mitigate the risk of data breaches.

Behavioral Analytics: By analysing user behaviour, behavioural analytics can detect anomalies that may indicate a security threat. This technology can help organisations identify and respond to insider threats.

Blockchain Technology: Blockchain can create immutable records of transactions and data, making it a valuable tool for cybersecurity. It can also protect sensitive data, prevent fraud, and ensure data integrity.

Quantum Computing: While still in its early stages, quantum computing has the potential to revolutionise cybersecurity. Quantum computers could be used to break current encryption algorithms, making it imperative for organisations to develop new encryption methods.

C-level executives must take a proactive approach to navigate the evolving cybersecurity landscape. Here are some critical steps that organisations can take to prepare for the future:

1. Develop a Robust Cybersecurity Strategy: A comprehensive cybersecurity strategy should outline the organisation’s goals, objectives, and risk management approach.

2. Invest in Cybersecurity Talent: organisations need skilled cybersecurity professionals to protect their digital assets. Investing in training and development can help organisations build a strong cybersecurity team.

3. Conduct Regular Risk Assessments: Risk assessments help organisations identify and prioritise potential threats.

4. Implement a Strong Incident Response Plan: A well-prepared incident response plan can help organisations minimise the impact of a cyberattack.

5. Foster a Culture of Cybersecurity: Creating a culture of cybersecurity awareness can help employees understand the importance of security and report suspicious activity.

6. Stay Informed: C-level executives must stay informed about the latest cybersecurity trends and threats. This can be done through industry publications, conferences, and professional networks.

The cybersecurity landscape constantly evolves, and C-level executives must be prepared to adapt to new challenges. By understanding the regulatory changes, emerging trends, and innovative technologies shaping the industry, they can take proactive steps to protect their company’s digital assets and mitigate the risk of cyberattacks.

What would it be if there was one key takeaway you wish our readers could bring home from our conversation?

Information Security is paramount, whether you are a business owner or an individual. Anything that cannot be measured cannot be managed, which is true in securing cyber risk.