Who cares about cybersecurity

Cybersecurity - growing concern or another thing to ignore.

Now you might be confused for thinking I am about to start a cyber security geek rant, about the fact that cybersecurity is given no airtime during board meetings, that security officers have to beg for a budget, and how three of the top five high risk target industries spend less on security combined globally, than the number one financial services firm does on its own.

But let's be fair no one really cares about cybersecurity, no one cares that their password is password, and why on earth should they be interested in security ?

I do not care to understand how electricity is made and delivered, how thermal induction works, or how bi-metalic, thermostatic switches behave. I just want to know that when I push the button on the top of the kettle it will boil water so I can make a brew.

Likewise security is not the end goal, it is just a means to what we really want, risk transference and peace of mind.

My job as a senior leadership consultant means I often have to give company owners an overview of why their security has major holes in it, but in order to do so it requires an assessment, and this is where it falls over. It isn't because they don't believe in my abilities, or that our certified engineers can successfully pinpoint weaknesses and help them fix them, or that our report would be lovely and glossy with cool graphics. Basically they just don't care.

The reason they don't care is it is all rather speculative, "are you secure enough?", "are you safe ?". Unfortunately security is not black and white, safe/not safe.

But Managers want risk transference, they want to be told they are safe, that they can't be hacked, and that they will not suffer a data breach. And they want to be able to say "I have no idea why this happened we had all the best security installed", they therefore don't want to be told that that same technology is not enough.

Cyber security, reminds me of an old joke about two hikers faced down by a hungry lion, one man turns to the other and says "I think we should run", the second man asks with mock jest "you really think you can outrun a lion ?", to which his friend replies with a wry smile "I don't have to outrun the lion, I just have to outrun you!".

In cyber security you can't be hacker proof, you can't be totally safe, but you can check your defences so you know your limitations, and fix the simple things that cost little to fix, each step you take makes you faster than the guy next to you, and makes them more attractive than you to an opportunistic hacker.

You will be surprised how much difference you can make by doing very simple things, and very easy changes to your current equipment within your organisation.