UNSECURITY Episode 98: Accountability in InfoSec

### Overview In Episode 98 of the UNSECURITY Podcast, co-hosts Evan Francen and Brad Nigh discuss the foundational role of accountability in information security programs across both private and public organizations. They argue that technical controls and investments are rendered ineffective without clearly defined, top-level responsibilities. The episode also reviews recent company updates, templates released for incident response and work-from-home security, and current cybersecurity news events.

### Key Topics - **Establishing Accountability at the Top**: Accountability in information security must originate with executive leadership, the CEO, or the board of directors rather than defaulting entirely to IT or the CIO. The hosts highlight how IT leadership frequently has competing priorities with security and should not be left solely accountable without explicit governance, support, and resources. - **Tools and Governance Frameworks**: Defining responsibilities requires formal documentation rather than assumptions. The hosts discuss tools such as an Information Security Committee Charter to outline executive duties, and a one-page "ransomware recovery contract" designed to establish clear mutual agreements between executive leadership and IT teams regarding backup protections and exceptions. - **Accountability Across Sectors**: Examining governance in public entities like cities, county governments, and school boards, the hosts note a prevalent disconnect where top elected officials often pass off cybersecurity ownership directly to IT personnel. Reference is made to the City of Baltimore ransomware incident to illustrate the massive financial impact ($18 million) when oversight and accountability fall short. - **Macro Accountability and Software Vendors**: The discussion extends to software manufacturers (such as Microsoft, Adobe, and Oracle) and the industry-wide acceptance of critical software bugs and vulnerabilities without adequate vendor accountability or customer recourse, despite increasing reliance on critical software in healthcare and autonomous systems.

### Technical Details - **Incident Response & Program Updates**: Brad details updates to their vCISO program ("FACT" program version 2) and an incident response (IR) maturity assessment and plan template addressing regulatory frameworks like PCI and HIPAA. The hosts also discuss the release of Security Studio version 3.9 and a specialized work-from-home security policy template. - **Ransomware & Backup Protections**: The conversation emphasizes defensive basics: routine backups (including local disc restoration, DR replication, and offline tape backups), network segmentation, network isolation, firewall protections, and external vulnerability scanning to remove low-resistance attack vectors. - **News Rundown**: - *Healthcare Ransomware Death*: A ransomware attack in Düsseldorf, Germany, knocked 30 hospital servers offline and led to the death of an emergency patient whose treatment was delayed by an hour after being diverted to Wuppertal. - *Google Play Store Stalkerware Ban*: A policy banning stalkerware—code that transmits personal info without adequate notice/consent or persistent notification—effective October 1. - *U.S. IoT Cybersecurity Improvement Act*: Bipartisan legislation directing NIST to establish security standards for IoT device development, patching, identity, and configuration management.

### Takeaways - Accountability must be formally documented and established from the start, well before purchasing vendor products, hiring an MSSP, or writing technical policies. - Executive leadership and boards must receive regular updates (such as quarterly written briefings and annual reviews) and provide the necessary funding, staffing, and authority. - Practitioners should address accountability directly with executive leadership, and if leadership refuses to accept responsibility or support necessary protections, security professionals should consider leaving rather than taking the fall for unmitigated systemic risks.