The challenges CHROs face with cybersecurity

At one of Australia’s largest law enforcement agencies, when an employee requests annual leave, their manager receives an automated email notification that asks them to click on an embedded link to approve the leave application.

This process contradicted the information security training that advised staff against clicking on links in emails. Phishing emails sent by malicious actors asking staff to click on links to malicious code or websites are one of the most common, simple, and cost-effective methods used by criminals to gain access to corporate information.

When it was identified by the CISO and communicated to the IT department that managed the HR information system, it became clear that HR had themselves defined the requirements and the process that IT implemented. HR objected to changing this process because it would make it harder for managers. IT objected to changing the system because there would be a cost to change...