Where IT Leaders Share Ideas
Describing Cyber Security as a risk is a language oddity that keeps appearing at an alarming rate. It is a dangerous and simplistic shortcut: Cyber Security results from the proper application of proportionate Controls to protect an organisation from the Cyber Threats it faces. Cyber Risk results from the absence or inefficiency of such Controls.
Fundamentally, the Board of Directors needs to go back to basics on cyber security matters: Time has now gone to continue approaching cyber security purely from a Risk perspective. Risk is ultimately about “things that may or may not happen”. When it comes to cyber security, the Board should start from the premise that cyber attacks are a matter of “when”, not “if” – and should shift the focus towards understanding and managing what is actually getting done to protect the organisation.
We are coming to a point in many large firms where true “innovation” in the cyber security space does not consist in deploying the latest tools, but in going back to the governance drawing board.
In earlier articles, we have examined the challenges of the CIO around Information Security, the importance of the CISO reporting line, and the fundamental role the Board of Directors has to play to drive security transformation.
Here, we revisit and develop further some of these aspects in line with new reflexions and some feedback we received.
The theft of the email addresses and other account details of 500 million Yahoo users is a golden opportunity for cyber-criminals working with bad-bots.
Those who use Yahoo to provide their principal email account should have been concerned by news of the leak. Many others, with an old Yahoo account that they do not use much, may not have been that bothered. Is such complacency justified? That depends, to gauge the risk you need to understand the cyber-crime opportunity represented by 500 million accounts.
Workload mobility and the need to maintain SLAs will be a defining feature of Unbounded IT and it is in the sphere of Cyber and Information security where I think the business will first force IT to reevaluate some its most deeply held dogmas and static thinking.
