Cyber Security: When True Innovation Consists of Doing Now What You Should Have Done Ten Years Ago

by | Jan 3, 2017 | CISO WaterCooler, Digital Transformation, Feature, Information Security, Role of the CIO | 414 comments

Cyber Security: When True Innovation Consists of Doing Now What You Should Have Done Ten Years Ago

Year after year, major surveys highlight low levels of cyber security maturity across large firms, and increasingly an even more worrying situation amongst smaller firms. The 2016 RSA Cyber Poverty index is a good example of that trend. It truly paints a grim picture, but simply confirms findings that seem consistent across all large surveys – even if methodologies do vary.

Most of those surveys have another point in common: They are – in some form or another – organised or sponsored by heavyweights of the cyber security industry or large consultancy firms, who ultimately can be suspected of having an interest in accentuating negative traits in order to maximise their own sales.

But even if the results of those surveys have to be taken with great care for that reason, they do match an enormous amount of anecdotal evidence we come across in the field every day: Too many large firms – leaders in their field – are still struggling with fundamental basic principles of cyber security hygiene that have been regarded as good practice for 10 to 15 years, and for which technical solutions and organisational processes have been in existence for as long:

  • Monitoring of basic network security events
  • Timely deployment of security patches on servers and desktops
  • Timely removal of user accounts
  • Periodic revalidation of access levels with business units

It cannot be suggested that solving those problems is easy in large firms, and to a large extent the disappearance of the traditional business perimeter of the enterprise and the digital transformation of supply and value chains have made things even more complex.

But those good practices have been relentlessly pushed forward by auditors and regulators, as well as infosec professionals, for the best part of the last 10 to 15 years. Very large amounts of money have been spent with tech vendors on alleged solutions in those areas, so undoubtedly it is concerning that so little progress seems to have been made by so many firms in those domains over such a long period of time.

The most common root cause is a constant short-termist approach by senior management, focused solely on alleged “quick wins” or illusory technical solutions to audit or compliance problems, at the expense of the more complex process and governance transformation issues that would have driven real change but would have required a longer term vision and approach.

The technology industry has done little to break those dynamics: In fact, it has been happily riding that wave for a long time, and the trend shows no signs of abating. It also has a long standing tradition of re-inventing itself, and the cybersecurity sector is no exception. Most security vendors are now embracing emerging technologies such as Artificial Intelligence or Machine Learning, as well as more established platforms such as Big Data, and present as “innovative” Cloud-Based delivery models that in fact have been in existence – for some of them – for over 10 years.

They paint to their clients a situation where threats morph constantly, and therefore new tools are constantly required; and it may well be the case to some extent in some industries. But the harsh reality is that many of their clients don’t have the basic processes in place that would enable them to take full advantage of such products, and at best they simply continue to buy those to put ticks in audit or compliance boxes, when it is not merely as a pet project for the CISO.

Many board members have woken up over the past few years to a situation they don’t understand, being told all of a sudden that data breaches are simply a matter of time, often by the same people who have been telling them for years that everything was under control.

They need to realise that this is not just an external situation created by the acceleration of threats or some adverse economic or geopolitical outlook. Quite often, it is also the symptom of a serious internal problem rooted in decades of short-termism, adverse prioritisation of security matters and a complacent “tick-in-the-box” culture around audit and compliance.

We are coming to a point in many large firms where true “innovation” in the cyber security space does not consist in deploying the latest tools, but in going back to the governance drawing board, to look at long-term actions and remove the roadblocks that have prevented progress in the past, redesigning fundamental security processes across IT, the business and other support functions (such as HR etc…) in order to rebuild proper and functional operating models conceived to protect the organisation once and for all.

 

This article was first published on the Corix Partners blog on 8 December 2016.

Corix Partners is a Boutique Management Consultancy Firm, focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation & Governance challenges.

414 Comments

  1. stornobrzinol on 24th June 2021 at 1:30 am

    Some truly fantastic articles on this website, regards for contribution. “My salad days, When I was green in judgment.” by William Shakespeare.

  2. Europa-Road on 7th July 2021 at 5:37 pm

    Just a smiling visitant here to share the love (:, btw outstanding style.

  3. slot online ikan on 14th October 2021 at 11:43 am

    Hello my friend! I want to say that this post is awesome, nice written and come with approximately all significant infos. I would like to look more posts like this .

  4. zortilo nrel on 31st October 2021 at 5:45 pm

    obviously like your web site but you need to take a look at the spelling on several of your posts. Many of them are rife with spelling problems and I find it very troublesome to tell the reality on the other hand I’ll surely come again again.

  5. mouse trap on 26th November 2021 at 5:46 am

    Howdy would you mind stating which blog platform you’re working with? I’m looking to start my own blog soon but I’m having a hard time making a decision between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your layout seems different then most blogs and I’m looking for something completely unique. P.S Sorry for getting off-topic but I had to ask!

  6. sign in on 13th December 2021 at 8:12 am

    I’m no longer sure where you are getting your info, however good topic. I must spend a while finding out more or understanding more. Thank you for excellent info I was in search of this info for my mission.

  7. Zutrittskontrolle on 15th January 2022 at 2:40 pm

    I loved up to you’ll receive performed proper here. The comic strip is attractive, your authored material stylish. however, you command get got an impatience over that you would like be delivering the following. sick unquestionably come further until now again since exactly the same just about very often inside case you shield this hike.

  49. luxury car rental miami on 3rd February 2022 at 4:10 pm

    Heya just wanted to give you a brief heads up and let you know a few of the images aren’t loading properly. I’m not sure why but I think its a linking issue. I’ve tried it in two different internet browsers and both show the same results.

  171. Gilberto on 16th March 2022 at 3:10 pm

    At this time it seems like Drupal is the preferred blogging platform out there right now.

    (from what I’ve read) Is that what you are using on your blog?

  175. Sherrie Laplaunt on 18th March 2022 at 4:01 pm

    Great. This article is absolutely what I have been looking for.

  185. zomenoferidov on 20th March 2022 at 11:04 pm

    My brother recommended I might like this web site. He was entirely right. This post truly made my day. You cann’t imagine just how much time I had spent for this info! Thanks!

  408. fredbend on 20th May 2022 at 10:10 am

    However, it allows you to stay away from complex and comically huge presentation modes that add bloat to the application and can intimidate users.
    In addition to feeds, the feed reading utility is capable of working with pictures and videos. Along with the basic image and video viewers, similar to VLC, you can also access popular conversion utilities for audio and video content.
    Built-in torrent client
    As mentioned before, the package integrates the BitTorrent protocol in order to provide the user with https://vilisefect.weebly.com

    6add127376 fredbend

  410. godmarg on 20th May 2022 at 3:48 pm

    Are Celebrities More Famous Than Us? – prostoalex

    ======
    fredkblanchfield
    > VCs and talent agencies know as much about the market today as they did 100
    > years ago. And in his study https://derssadoreal.weebly.com

    6add127376 godmarg

  411. yevwyl on 20th May 2022 at 4:36 pm

    */
    box-shadow: inset 0 -1px 0 #bbb;
    /**
    * By default the indicator appears in the default position at the bottom of the label field.
    * Set `position` property to a value other than “bottom” to move the indicator to another position.
    * For example, pass a px value for horizontal offset, like 200px, when https://maps.google.com.kw/url?sa=t&url=https://chicrarasul.weebly.com

    6add127376 yevwyl

  412. chaskri on 20th May 2022 at 4:54 pm

    Even if you never use the software for tinnitus treatment, that alone is a major plus for users.
    Not only does the program generate sounds which were made to mask tinnitus, it can also be utilized for listening to music or watching videos at your own leisure.
    Built just to help you
    Although testing the program is ideal for all users, the best way to review it would be to provide it to someone who is suffering from tinnitus.
    That would most probably https://osjulutap.weebly.com

    6add127376 chaskri

  414. zorivare worilon on 30th June 2022 at 7:38 am

    I rattling glad to find this web site on bing, just what I was looking for : D as well saved to fav.

Submit a Comment

Your email address will not be published.