“By 2025 Cyber attackers will have weaponized Operational Technology Environments to successfully harm or kill humans” – Gartner
Cat and mouse games between the hackers and the enterprises are getting scarier day by day. COVID-19 has pushed more and more organizations into digitization. Of course, digitization brings in huge benefits in terms of operational efficiency and better user experience, but it also opens up new challenges needing protection from Cyber attackers.
Hence, the key question is how to protect organizations from Cyber attackers in the era of rapid digitization? The answer to this question is the Cybersecurity transformation journey.
This blog post covers key factors for a successful Cybersecurity Transformation:
Strategic alignment: A security initiative has to align well with the organization’s strategic priorities. This makes the Cybersecurity initiative a business enabler rather than merely a set of “controls”. The “control” kind of view portrays Cybersecurity as a hindrance to achieving success.
The moment the business lines start seeing Security function as an enabler, the whole paradigm shifts towards leveraging Cybersecurity for doing the business at ease. Hence, business alignment is key to getting business lines to team up with Security teams in achieving greater success. For example: If a business wants to launch a new e-commerce website for setting up online sales, then securing the website will attract more customers as the customers want to transact on a secure website.
Without the strategic alignment, time and effort would be spent in firefighting and finger-pointing, eventually leading to lose-lose outcomes.
Moving beyond Technology: Cybersecurity is often perceived as a “bunch” of techies trying to save an organization from being a victim of a hacker hiding behind a black hoodie! In reality, Cybersecurity is much more than this. Technology is just one side of the multidimensional coin. There are other sides, which are equally important. For example, an organization might have the best technology set up for securing passwords. If the organization lacks a strong policy framework that prevents administrative password sharing amongst the admin users, then even the best technology setup can’t save that organization from being vulnerable to internal threats.
Thus, for it to thrive:
Firstly- Cybersecurity has to move beyond being a technology problem to find itself a major space in the respective business domains. For this to happen- it would need senior and executive management backing as well as security champions' support from each of the business domains.
Secondly- organizations need to focus on technology as well as non-technology aspects such as Governance elements. For example Policy, standards, process maps etc.
Prioritizing investment: Securing everything to the same extent gives a false sense of security. The most critical assets need the highest level of security, hence the investment focus needs to be these assets. For example, an IT system that is used to store customer transactions is of higher priority than an IT system needed for conference room booking.
Prioritization has dual benefits. Firstly, it optimizes the security initiative enabling quicker go to market scenarios. Secondly, it will force businesses to participate in the Cybersecurity Transformation being partners for the success.
There are multiple ways to prioritize investment. One of the ways is to start from Corporate strategy to determine what is most critical for the business to operate. Another way is the risk-based approach, i.e. assets prone to the highest security risk, need the highest protection.
I have called Cybersecurity transformation a “journey” rather than merely a “point in time” initiative. The reason is that Cybersecurity transformations impact people, key processes and the existing technology landscape of the organization. Thus, the desired outcome can’t be achieved just by throwing in more money and resources. Like every long journey has a map, milestones, ups and downs, as well as a way to track the progress, Cybersecurity transformation needs to be steered through the transformation journey by the leader, of course with lots of tenacity!
In the era where we hear that organizations getting cyber-attacked, forced to pay hefty ransoms to regain access to their own IT systems, millions of customer records land in the cybercriminal’s hands almost every day, it is high time for organizations to take Cybersecurity very seriously. Once, the Cybersecurity department was just a checkpoint function to provide “sign-offs” for going live, now the equation has totally changed. From being a “control function” to a “business enabler” being part of the executive board, Cybersecurity has assumed a key role within the organization. The strategic Cybersecurity transformation journeys take organizations to control their future better rather than just leaving the organization at the mercy of fate and just being lucky “this time”!