Immune Systems: Information Security And Risk In 2016

Information Security And Risk

C-suite executives have woken up to the threat posed by data theft, denial-of-service attacks and vulnerable systems. In 2015, for example, a series of high-profile cases illustrated the degree to which such attacks can damage a company’s reputation, brand and, ultimately, profits. Where businesses once undervalued cybersecurity, considering it the domain of CIOs and IT departments, it’s now squarely at the top of the agenda. Recognising the threat is one thing. The challenge for organizations is to find ways of understanding the risks and constructing robust systems. In this article, I want to look at how a risk-first approach to IT security and shrewd recruitment can boost a business’s immune system.

Identifying Risk

As companies continue to digitize their operations, the potential of information security breaches to damage trust and their competitive position increases. Information security risks are multiple and manifold. They could, for example, involve companies that rely on information as a means of generating value, such as banks or energy suppliers who must address a wide range of threats.

cloud-security

Equally, any company that holds large quantities of customer information runs a risk. This risk is particularly acute for SMEs, for whom the financial costs of information security can be prohibitive. In the Digital Economy, information is an asset that creates value for organizations; but this value is what makes it vulnerable.

Identifying these risks evidently requires expertise and coordination. Many businesses no longer see information security as simply something to do with IT. Rather, IT security is now bound up with wider risk management policies. But old habits, and ingrained divisions, can still be an obstacle for organizations. This goes for IT departments as well as management. In the past, IT departments habitually addressed security challenges by starting with technology and costing before moving on to consider the potential risk of an investment. In 2016, however, security has moved to front of
people’s thinking. Investing in the right IT systems now means first identifying the risk and then finding the devices and technology.

Mind the Gap

One area where firms have been slower to respond, however, is recruitment. The shift in the landscape has opened up a sizable skills gap, with organizations competing to recruit and retain employees with the necessary skills and experience. While good news for employees who can easily
find opportunities in the public and private sectors, this has caused problems for CISOs tasked with sourcing and training the people who can both identify and take steps to mitigate the cybersecurity risks that businesses face. In this environment, the challenge for organizations is to find ways to open up career paths and build expertise into a business, while still keeping costs down. In a survey carried out by Deloitte, 59% of CISOs identified the inadequate availability of cybersecurity professionals as a barrier to information security, with many turning to outsourcing to fill the gap.

trends-security

To my mind, this barrier serves to reinforce the importance of taking holistic approach to information security. IT departments must communicate effectively with management and HR departments to ensure that risks are identified and addressed, and that the organization has the right people for the job. As digitization continues apace, getting this process right is only going to become more important.

By George Foot

Episode 16: Bigger is not always better: the benefits of working with smaller cloud providers
The benefits of working with smaller cloud providers A conversation with Ryan Pollock, VP Product Marketing and Developer Relationships for Vultr.com - Everyone knows who the big players are in the cloud business. But sometimes, ...
Frank Suglia
Managing Data Sprawl Over the last two years, our world experienced a dramatic acceleration of digital transformation. The COVID-19 pandemic upended normal operations for many businesses and shifted the pace of technology adoption into warp ...
Cloudtweaks Comic Ai
How AI Is Important for Businesses Shifting to Remote Work The Coronavirus Pandemic has taught us that organizations must have remote work choices. It is no longer possible to work in a digital environment. The ...
Yuliya Melnik
DevOps Services Outsourcing The sooner you release your unique idea to the public, the higher the chance that it will receive the lion's share of the audience's attention. Delays in development can lead competitors to ...
Gary Bernstein
Managing Your Internal IT Your company's internal IT team is responsible for keeping things running smoothly, and they deserve all the support you can give them. Here are ten ways to make their lives easier ...

SECURITY TRAINING

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.

  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.