The Big Interview: Peter Yapp, Schillings Partner & former NCSC Deputy Director: "Boards Need a CISO Who Reports Directly to Them"

[InfoSec News <alerts () infosecnews org>]

https://www.cbronline.com/interview/peter-yapp-schillings-interview

By Ed Targett
Editor
CBROnline.com
30TH June 2020

"Boards are a bit worried about looking ill informed"

Peter Yapp joined Schillings in 2019 from the National Cyber Security 
Centre (NCSC) where he was Deputy Director for Incident Management. He has 
held senior positions in both the cabinet office and the private sector. 
He now specialises in leading penetration testing and Red Teaming services 
for clients of the firm; which has pivoted from being a pure reputation 
management law firm, to a strategic crisis response consultancy with a 
muscular bench spanning intelligence, cybersecurity and risk advisory.

He joined Computer Business Review to discuss C-suite security reporting 
hierarchies, vulnerability assessments, Operational Technology (OT), 
supply chain risk, and talking to the board about cybersecurity. Below, 
the conversation, as we had it; lightly edited for brevity

Peter – could you give us a whistlestop tour of your career?

I started my career in investigations in Customs. I ended up running the 
high tech crime team until the late 90s. Then I went into consultancy. 
[After a stint at] Control Risks I decided to go on the inside and see 
whether all the advice I’d been giving was realistic: I ended up managing 
the global incident response team at Accenture, looking at what was 
hitting Accenture — not their clients, but the core. I was tempted back 
into government: partly because one of the things that I had talked about 
for many years was state-sponsored threat: I wanted to know how real that 
was.

I worked for CertUK and then the National Cyber Security Centre, where I 
ran the incident response team. Then I ran the critical national 
infrastructure (CNI) advice team. And latterly I was trying to solve the 
world’s problems by sorting out supply chain risk.  Now I’m at Schillings.

[...]

--
Subscribe to InfoSec News
https://www.infosecnews.org/subscribe-to-infosec-news/
Follow InfoSec News on Twitter
https://twitter.com/infosecnews_
Follow InfoSec News on LinkedIn
https://www.linkedin.com/company/infosecnews/