U.S. Bank CISO Says Cyber Risk Requires Shared Responsibility
Summary
U.S. Bank CISO Ann Barron-DiCamillo discusses the expanding security role, the need for cross-functional partnerships, risk-reducing investment, timely incident reporting, and stronger threat intelligence sharing among banks.
Key points
- CISO responsibilities increasingly span fraud, resilience, third-party risk, and AI governance, but one leader cannot manage every aspect alone.
- Effective cyber risk management depends on partnerships across technology, risk, legal, fraud, compliance, and business teams.
- Security spending should prioritize risk reduction and resilience over compliance evidence alone, including automation, asset visibility, and identity and vulnerability management.
- Incident reporting should support timely information sharing while allowing responders time to establish accurate facts.
- Banks can reduce duplicated analysis by sharing threat intelligence, technical indicators, and mitigation approaches while assessing their own environments.
- Cybersecurity risk is a shared responsibility, not solely the security team's.
Article Details
- Topic
- The expanding scope of the CISO role and the importance of partnerships and shared cyber-risk responsibility in the financial sector.