Cyber security it’s not just about technology

• The same applies to monitoringattacks. In many cases, organizationshave certain monitoring capabilities,but the findings are not shared withthe wider organization. No lessons, orinsufficient lessons, are learned fromthe information received. Furthermore,monitoring needs to be underpinnedby an intelligence requirement. Onlyif you understand what you want tomonitor does monitoring become aneffective tool to detect attacks.• Organizations need to develop anenterprise-wide method for assessingand reporting cyber security risks.This requires protocols to determinerisk levels and escalations, andmethods for equipping the board withinsight into strategic cyber risks andthe impacts to core business.5Mistake: “We need to recruit the bestprofessionals to defend ourselvesfrom cyber crime”Reality: Cyber security is not adepartment, but an attitudeCyber security is often seen as theresponsibility of a department ofspecialist professionals. This mindsetmay result in a false sense of securityand lead to the wider organization nottaking responsibility.The real challenge is to make cybersecurity a mainstream approach.This means, for example, that cybersecurity should become part of HRpolicy, even in some cases linked toremuneration. It also means that cybersecurity should have a central placewhen developing new IT systems,and not, as is often the case, be givenattention only at the end of such projects.7 | Cyber security: it’s not just about technology© 2014 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network ofindependent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.All rights reserved. Printed in the U.S.A. The KPMG name, logo and “cutting through complexity” are registeredtrademarks or trademarks of KPMG International. NDPPS 264522