From telecom carriers to e-commerce companies, a string of large-scale personal data breaches and cyberattacks last year shocked the public. Lax information management and complacent attitudes among corporate executives drew widespread outrage and drove consumers away from the companies involved.
Hacking across industries is no longer just a problem for individual companies. It has become a drain on national wealth as core industrial technologies and data flow overseas, and a serious threat to national security by destabilizing critical supply chains. Security is no longer the sole domain of the IT department — it has become a core management responsibility for CEOs who want their companies to survive.
Kim In-sun, a security and software journalist with 25 years of experience, and Jung Eun-a, CEO of security solutions firm Soosan INT, co-authored the new book "Boss, Security Is Management, Not IT." In it, they warn that "most executives know they need to do something about security, but actually have no idea where to start, where to stop, or how much to do." They add that "in an era where cyber threats move at speeds incomparable to the past, the delusion that 'it won't happen to us' is the single most expensive mistake a company can make."
The authors argue that hacking typically stems not from sophisticated technology but from a fundamental absence of basic precautions. Rather than spending months targeting a specific victim, hackers run automated programs that scan servers worldwide for the weakest entry points. In practice, numerous breaches have exposed neglected vulnerabilities — dormant accounts belonging to former employees or contractors, poorly managed encryption keys and authentication systems, and basic web security flaws.
Many executives take comfort in the belief that "the companies in the news are all big corporations," but small and medium-sized enterprises are no exception. Statistics show that SMEs account for 60 percent of private-sector companies that suffer hacking damage.
When a breach occurs, the fallout hits SMEs and small business owners far harder than large corporations. Major companies have the legal teams, public relations resources, and financial reserves to weather the storm, but for smaller firms, a single regulatory fine can wipe out an entire year's operating profit or push the company straight into insolvency.
"Security is a structural problem before it is a people problem — and building that structure is management's job," the authors write. In an era when AI-powered hackers have arrived, they argue, executives must view security as a matter of business decision-making and ask whether their existing review processes are still adequate.
"AI is a tool that raises a company's productivity, but at the same time it is amplifying attackers' capabilities," Kim said. "If a CEO does not understand security, it is the same as being blind to the company's most critical risk." She added that "this book is not a technical manual for security professionals — it is a management guide that tells the people responsible for running a company how to understand and make judgments about security."
Jung said that "security incidents may look like they erupt out of nowhere, but in practice they are often the result of neglected decision-making that has been left unaddressed for a long time." She added that the book focused on "breaking down the problems companies actually face on the ground in plain terms, so that CEOs and executives no longer feel that security is a difficult, distant subject."
pink@heraldcorp.com
