Cyber security isn’t IT – 5 key dangers

1 Siloed thinking creates unknowns

Thinking of cyber security as an IT function leads to a siloed approach to security. In many businesses, the IT department is responsible for security, and other departments are not involved in the decision-making process. This siloed approach means that other departments aren’t aware of the security risks they themselves face, nor how to mitigate them. It also means that the IT department may not have access to all the information they need to make informed decisions about cyber security.

This siloed approach can be particularly problematic when it comes to managing third-party risks. Third-party vendors and suppliers is the norm, and these vendors can be a significant source of cyber security risks through the supply chain. However, if other departments are not involved in the decision-making process, they may not be aware of the third-party risks or how to manage them. As a result, the business may be exposed to significant cyber security risks that could have been avoided.

2 Reactive vs. proactive security

The ‘cyber is IT’ myth also leads to a reactive approach to security. Many businesses wait until they experience a cyber attack or data breach before taking cyber security seriously. This reactive approach means that businesses are always playing catch up, and they may not be able to recover from a significant cyber attack. Ransomware in particular is easy for cyber criminals to do en masse, and it’s great at wiping out businesses. Many data breaches happen without businesses even being aware.

A proactive approach to cyber security involves identifying and mitigating risks before they turn into problems. Regular vulnerability scanning is cheap and easy, and, these days, regular penetration testing is seen as the norm. A proactive security approach needs buy-in and involvement from all departments. Ideally, a culture of security awareness too – but that’s a different challenge itself. By taking a proactive approach to cyber security, businesses can stay ahead of the curve and minimise the risk of a cyber attack or data breach.

3 Lack of accountability

Thinking of security as an IT function leads to a lack of accountability. If cyber security is made the responsibility of the IT team, other departments aren’t going to feel responsible for security. This lack of accountability means that cyber risks will be overlooked or ignored. It also means that if a data breach does occur, the blame is placed solely on the IT department, rather than the business as a whole. The ‘blame game’ culture is one of the most underrated threats to your business security.

Instead, work to install a culture of accountability, rather than blame. All employees need to understand their role in protecting the business from cyber attacks and data breaches, they need to be aware of the risks and how to mitigate them, and they need to be held accountable for any security lapses or mistakes. How? Well, annual security training is usually a good start.

4 Underinvestment

A lack of investment in cyber security is a common outcome of treating it as an IT function. If it’s seen as an IT problem, it only gets a part of the always-stretched IT budget. And this means inadequate security measures. Cyber security requires investment in IT tech, of course, but it also needs personnel, process and training. Getting board-buy in is essential for this, and is one of the things a CISO, or virtual CISO, can help with.

5 Low understanding of risk

Thinking of cyber security as an IT function can lead to a lack of understanding of the risks it presents. This applies in broad strokes at the C-level, and in narrower terms of user behaviour. For example, non-IT employees (and really, even some IT employees) may not be aware of the various cyber threats that the business faces or how to protect against them. As a result, they may unintentionally put the business at risk by engaging in risky behaviour, such as using weak passwords or clicking on suspicious links.

It's essential to provide all employees with cyber security training to ensure that they understand the risks and how to mitigate them. This training should cover topics such as password hygiene, email phishing, and social engineering. It should also emphasise the importance of reporting any suspicious activity to the IT department.