The saga of the Sony PlayStation Network's ineptitude with trying to get back on the air after a huge break-in seems to be another example of mismanagement at the board level. The consequences of the break-ins are huge – could be millions of accounts have been compromised including credit card info, the PlayStation Network is off the air, customers are angry and confused. The Sony Brand is melting away. Eventually we'll all find out what happened and most likely it will come in very technical terms – the stuff that makes the RSA Conference so interesting. But what's more important is what probably didn't happen – did the Sony board of directors ever ask its IT team to determine what would be the worst case security breach that could happen which could destroy the Sony brand? And to make sure that it never happens, no matter what the cost. In case after case (breach after breach) it appears that the boards of directors of major companies are not asking the right questions and are not insisting on brand protection from online antagonists. The board structure is there – the board of directors at every major public company has an audit committee composed typically of several of the outside board members. They're the ones who should be asking "what's the worst case scenario" and "show us the plan for preventing this." Strangely enough, that pretty much was what happened when the Y2K concerns happened. Companies are making more than enough money online to build in the necessary defenses. So why isn't it happening now? One reason that we can think of is that it's the security industry itself – can you recall any of the major security companies meeting with board members of the top 100 public companies saying "you know, your brand is in jeopardy – this is what you should be worried about?" If Steve Jobs woke up one day and was CEO of a major security company instead of running Apple, don't you think that he'd deliver this sort of board level message? You can start at the bottom of the organization and it might take you years to work your way up, or you could start at the very top and get an edict to immediately do what's necessary to defend the brand from attack.