IT security
IT security trends
With the advance of Industry 4.0, organizations are increasingly choosing to migrate their systems to the cloud, to which millions of computers and IoT devices can be connected. This poses a major cybersecurity challenge for companies, which have to keep watch over an ever-growing number of vulnerabilities. Set against the rise in attacks we see day to day, 75% of industry experts consider cybersecurity the top priority right now. So why do so many companies remain so vulnerable? A McKinsey report1 identified the three main causes affecting most organizations:
- They see it as a problem for the IT department alone, which should solve it: management often does not even understand the technical language of IT and, as a natural reaction, delegates the problem to the IT department.
- Throwing resources at the problem blindly and hoping it goes away: the trouble is that, no matter how much is spent, it is impossible to fully shield every IT asset in an organization. Studies also show that there is often little correlation between what a company spends on security and the success of its cybersecurity programs.
- Treating IT security as a mere matter of regulatory compliance: an organization may be able to tick every box the current standard requires and still be vulnerable.
What would the solution be?
The main problem organizations face is that it is absolutely impossible to be completely safe from every possible type of attack. What is more, around half of all attacks involve the company's own employees, whether through carelessness (clicking on malicious emails) or outright bad faith (for example, employees trying to sell intellectual property to competitors). Because of this, the only way to have a coherent security strategy is prioritization. The key steps would be the following:
- Take inventory: The company must inventory all of its digital assets, including data, systems and applications.
- Assess the risk: each asset must be assigned a level of criticality, not only from the IT point of view but from the point of view of the company's entire business model. This will require the involvement of the whole management team, not just the IT department.
- Identify attacks: the most likely attacks on the inventoried digital assets must be identified and compared against the systems' current defenses. Are they enough? Is there a gap between the criticality of some assets and the existing defenses?
- Update the systems: finally, organizations must improve the security of those assets where there is a gap between the level of criticality and the level of security, according to the criteria in place and the level of risk they are willing to accept.
This approach is not easy, since it requires cooperation between different areas within the same organization that often have competing interests, for example: business management versus IT management, or employees who may see their daily work disrupted by additional controls.
Automation is here to stay, so it is important to approach security proactively rather than reactively, so that the proliferation of systems and devices is truly an asset for companies and not a large target for potential cyberattacks.
1 Perspectives on transforming cybersecurity: Digital McKinsey and Global Risk Practice, March 2019. The information in this article is a summary of the contents of that report.