From: The Guardian
When it comes to better information security, every company needs to invest in its people
When people hear cyber security they automatically think of IT. So when organisations hear the words “cyber security breach” there is often a tendency to leave it with the IT department, not only to deal with the breach but to ensure the breach doesn’t happen again.
If I told you human error (and systems glitches) caused nearly two-thirds of data breaches globally in 2012, would you quantify that as an IT issue? Currently, what tends to happen is at the first mention of poor cyber security, all eyes turn to look at the chief information officer – but are organisations right to single him or her out?
They are not. Examples of true incidents that have been labelled cyber security breaches are as follows: a mis-sent email (a strategy document sent to a competitor); commercial papers lost on a train; a former employee that was not legally prevented from taking bid information to a competitor; a laptop left on a plane with passwords attached; and careless use of social media giving away IPR, and more frequently, because it’s cheaper, the use of social engineering (“new best friends” who buy you drinks all night at the bar, fascinated by your company).
So what can we learn from these breaches? The majority of the above examples could have been prevented with a holistic, organisation-wide approach to cyber security. It turns out that people, the most valuable resource, are invariably also the weakest link. So every company needs to invest in its people and this starts with the board.
Interestingly, especially in large engineering, manufacturing or service-based organisations, there is quite often a flourishing, vibrant and effective health and safety culture – clearly understood and rigorously adhered to by management and employees alike.
But when it comes to the life blood of an organisation, its critical business information, there is often a distinct lack of collective education, training and focus to support a company’s business objectives, as well as suitable ICT products to use. Moreover, effective business processes, and the governance structures necessary to foster the correct pervasive culture of information risk management are also missing.
To make the necessary changes to value and exploit an organisation’s information better, the board needs to be fully engaged; the cultural change needed to successfully introduce an effective health and safety regime is not too dissimilar to that of holistic cyber security and this has to start at the top; board members need to lead by example.
Poor leadership will not inspire cultural change, no matter how hard internal communications try to advertise best practice. In addition, it is no good if board members are recklessly using social media, emailing sensitive work to their home accounts, viewing board papers on the latest insecure ICT, or asking for the latest tablet just so as to look good at the next conference they turn up at.
Good cyber security can only come from a holistic strategy set by the board, and it will only flourish through positive leadership and proactive information governance. All elements of an organisation must know who, what, why and when they are to share company information with and manage their critical business information.
This needs a collective corporate understanding of the threats and risks to different types of information; and knowledge of the shared technical and business processes for safely handling them, while at every given opportunity safely exploiting the information to get as much value from it as possible.
Andrew Fitzmaurice is CEO of Templar Executives
Leave a Reply