You must have been taking a long (and probably well deserved) holiday if you have not noticed the increasing use of the term “cyber” in the press recently.
Anything security related is now a cyber risk, a cyber incident or a cyber attack. Governments are driving cyber strategies, citizens need to be cyber aware, businesses are tabling cyber projects, companies are building cyber capabilities, vendors are creating cyber solutions and consultancies are creating cyber practices to help you enhance your cyber resilience.
With all this hype, the key question is - what is different from the infrastructure and information security we have been doing for years and this new cyber approach? This is a good question because everyone seems to have a different perspective on cyber. And for very good reasons.
At Symantec, we get the opportunity to discuss the different interpretations of cyber with many types of users and businesses – consumers, small and medium business, governments and global enterprises. We have found that cyber risk is really a complex and overlapping set of business and technical challenges that depending on your focus, business model or security maturity means something different for you.
These challenges include many of the more newsworthy cyber risks we see in the press on a frequent basis. However, we shouldn’t forget that cyber risks also encompass less newsworthy day to day challenges as well. Cyber challenges can include increasing business digitization and heightened levels of connectivity, increasing complexity - partially from rapidly evolving IT trends such as mobile and cloud adoption, advanced malware attacks, denial of business services, brand and intellectual property protection, financial loss, online citizen/employee awareness, hacktivism and nation state espionage & attacks.
This is why the industry is finding it very hard to create a widely accepted definition for the term and a common approach to address.
Some security professionals dislike the term ‘cyber’. I can understand why. It includes many of the challenges that security teams have been defending against for years. However, cyber security is more than just traditional infrastructure & information security and needs to embrace a new approach switching from a passive defensive position to an more integrated and active defensive stance.
Even though Cyber is a hyped term, the cyber phenomenon provides two key opportunities:
Firstly, the cyber phenomenon allows IT focused teams to connect much better with the business owners. Why? All too often business owners are completely disconnected from IT security. At best they consider it an additional cost or delay, at worst, something that they do not understand or does not concern them. Leveraging the cyber language changes this conversation because the hype of cyber means that all people, including business owners, are developing an awareness of the risks associated with IT systems. The opportunity here is for IT teams to leverage this increasing awareness by positioning future security projects in terms that are more relevant and impactful for business owners.
Secondly, the cyber phenomena provide the opportunity to change our approach to IT security. In fact, it is not an opportunity but a necessity. The old approach of passive defense with non-integrated control points needs updating. We need a new active defensive approach that promotes controls and processes that provide enhanced integration, agility, visibility and information sharing.
The Cyber phenomenon is here to stay. Let’s find the opportunity within the hype.