Cyberwashing: The disconnect between cyber security claims and real practices

Abstract

Cyber security continues to be an issue for organisations, particularly those that collect and use personal information. The implementation of a robust risk assessment and detailed control framework which is focused on addressing key threats is critical to achieving cyber resilience. Some organisations are keen to espouse their cyber security credentials, often in an effort to satisfy regulators, assure stakeholders and placate consumers. Regardless of this rhetoric, however, some of these organisations still suffer from a cyberattack. What does it mean when these words are not put into practice?