The challenges of working at top-tier research and teaching institutions are largely cultural. Social engineering is an even more difficult vector to address. Identify and credibly stack rank risk across the organization, ensure this information is presented to and understood by the right levels within the organization to make decisions on risk treatment, and then ensure those decisions are carried out. Have a retainer agreement for incident response for supplementation of internal labor and appropriate management of apparent conflicts of interest. Practice with the technical team, make the case for full practice and participation by the CEO, Legal, Public Relations, and other usual suspects on the leadership team.”]
Source: https://securityaffairs.co/wordpress/65390/breaking-news/interview-ciso-yale-university.html