Slashdot Mirror
Cyber Security Should Be Expanded To Departments Other Than IT: CII-KPMG (www.bgr.in)
An anonymous reader shares a BGR report: Cyber threats today are no longer restricted to a company's communications and IT domains, calling for more than just technical controls to avert attacks and protect the business from future risks and breaches, a new report said. According to the joint report of the Confederation of Indian Industry (CII) and KPMG, cyber security today embraces multiple units of an organization like human resource, supply chain, administration and infrastructure. It, therefore, requires governance at the highest levels. "It is vital to keep pace with the changing regulatory and technology landscape to safeguard and advance business objectives. Working backwards by identifying and understanding future risks, predicting risks and acting ahead of competition, can make a company more robust," said Richard Rekhy, Chief Executive Officer, KPMG, India.
Do I agree that other departments need training in security?
HELL THE FUCK YES! The nastiest hole in most security systems are the stupid meatbags being stupid on their computers.
Do I think that there should be SOME input back from these other departments too? Sure. But in a healthy organization, this is already the case.
Do I think that these departments should be given policy and decision making powers over security policy?
HELL THE FUCK NO! That's like putting a blind and deaf sheep that's considered stupid (even by sheep standards) in charge of a flock in an unfenced field in wolf country.
In short, while feedback is welcome, and good ideas are always welcome, managerial control isn't. Because it's not their job.
Chas - The one, the only.
THANK GOD!!!
The biggest problem in IT Security, is all the decision (those people outside of IT) claim ignorance, as those IT guys just talk techno babble.
So when there is legitimate problems, they just ignore IT and tell them to fix it. Vs. trying to take some time to learn about the problem and see if there are other solutions than just a computer fix.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Security was; is and never will be a technical solution for just IT. From the beginning it was clear that most of it was social enginering. Security is more a mindset.
As many went through IT related ways (computers), the IT departments told us over and over again that they would take care of it with more and more technical solutions.
We are all aware that technical solutions for social problems don't work. People will write down their passwords, because they have too many. People will tell them to somebody who says he is from IT. People will do things, because they are afraid their boss will yell at them if they don't. They palm people into buildings. And all because they have no idea why it is so dangerous.
People are not even interested in protecting their own identity and secrets and make themselves volnerable to attacks. If they do this to them selves, why would they not do it for the company they work for?
The reason is simple: ignorance. You need to explain that if you give one piece of the puzzle (e.g. just the first number of your CVV code) if they get the otherpieces elsewhere, they have all of the information.
So it is indeed now up to IT to realize that they have been lying and finally start to understand that security is a state of mind and not something you can deal with as if it were a bug (or a feature). NEVER solve a social problem with a technical solution.
Don't fight for your country, if your country does not fight for you.
Security is a process that you have to integrate in to every aspect of your business. It should be part of your training, planning, policy, business process, etc.
Trouble is, those that control the pocket books don't see it that way. They've been convinced that security is a service, or worse an appliance. It's a neat line-item that ticks a box and should be priced out to the lowest bidder.
To be fair, they see everything that way. Makes their jobs easy when leadership is a spreadsheet, a report, and a golf game with the bosses instead of.. You know, actual work.
You ever wondered why so many large organizations seem like such disjointed, jumbled up messes with ill-fitting parts that don't communicate well? Yeah.
so more Shadow IT? or more we can do are own at lower cost (at the places that have IT bill other departments) and more PBH fights over stuff that they do not know that much about. I read in PBH magazine that we need to have X and I don't thing X.1 (just about the same thing) will cut it.
I can easily see the theoretical value in this. In practice, this will just scare and confuse 99% of non-IT people.
Corporate cybersecurity must operate in such a way that it doesn't require the end users' cooperation, or it will fail. Sure, you can teach people best practices, how to spot phishing attacks, not to use the same password on every system they use; but as soon as you move beyond that, you've set yourself up for complete failure.
In fact the opposite should happen. They should be removed from any level of access to anything that requires security to protect peoples data. And not to be harsh on them, so should any employee honestly. Usually it turns out the least secure people in the company have the most access to customer information. This is the system we have today because they are the people that directly interact with the customer and are typically new people hired freshly from the street since turnover rate in call centers/fast food is so high. We need a different process entirely to create a secure way to provide PCI / PII . It should never even have to be provided manually to another human getting paid minimal wage.
IT should be given greater control.
This has always been the case.
Unfortunately, most companies treat information security as an IT task instead of a company wide mindset.
In the push and pull of security vs. convenience IT generally loses.. but they *do* get to take the blame once things go wrong.