Cyber security it’s not just about technology
1Kz4pTS
1Kz4pTS
- No tags were found...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
02The five most common cyber<strong>security</strong> mistakesTo many, cyber <strong>security</strong> is a bit of a mystery. This lack of understanding has createdmany misconceptions among management <strong>about</strong> how to approach cyber <strong>security</strong>.From our years of experience, we have seen the following five cyber <strong>security</strong>mistakes repeated over and over – often with drastic results.1Mistake: “We have to achieve100 percent <strong>security</strong>”Reality: 100 percent <strong>security</strong> is neitherfeasible nor the appropriate goalAlmost every airline company claims thatflight safety is its highest priority whilerecognizing that there is an inherent risk inflying. The same applies to cyber <strong>security</strong>.Whether it remains private or is madepublic, almost every large, well-knownorganization will unfortunately experienceinformation theft.Developing the awareness that100 percent protection against cyber crimeis neither a feasible nor an appropriategoal is already an important step towardsa more effective policy, because it allowsyou to make choices <strong>about</strong> your defensiveposture. A good defensive postureis based on understanding the threat(i.e., the criminal) relative to organizationalvulnerability (prevention), establishingmechanisms to detect an imminent oractual breach (detection) and establishinga capability that immediately deals withincidents (response) to minimize loss.In practice, the emphasis is oftenskewed towards prevention – theequivalent to building impenetrablewalls to keep the intruders out. Onceyou understand that perfect <strong>security</strong>is an illusion and that cyber <strong>security</strong>is “business as usual,” you alsounderstand that more emphasis must beplaced on detection and response. Aftera cyber crime incident, which may varyfrom theft of information to a disruptiveattack on core systems, an organizationmust be able to minimize losses andresolve vulnerabilities.2Mistake: “When we invest in bestof-classtechnical tools, we are safe”Reality: Effective cyber <strong>security</strong> is lessdependent on <strong>technology</strong>than you thinkThe world of cyber <strong>security</strong> is dominatedby specialist suppliers that sell technicalproducts, such as products that enablerapid detection of intruders. These toolsare essential for basic <strong>security</strong>, andmust be integrated into the <strong>technology</strong>architecture, but they are <strong>not</strong> the basis ofa holistic and robust cyber <strong>security</strong> policyand strategy. The investment in technicaltools should be the output, <strong>not</strong> the driver,of cyber <strong>security</strong> strategy. Good <strong>security</strong>starts with developing a robust cyberdefense capability. Although this isgenerally led by the IT department, theknowledge and awareness of the enduser is critical. The human factor is andremains, for both IT professionals andthe end user, the weakest link in relationto <strong>security</strong>. Investment in the best toolswill only deliver the return when peopleunderstand their responsibilities to keeptheir networks safe. Social engineering,in which hackers manipulate employeesto gain access to systems, is still one ofthe main risks that organizations face.Technology can<strong>not</strong> help in this regardand it is essential that managers takeownership of dealing with this challenge.They have to show genuine interest andbe willing to study how best to engagewith the workforce to educate staff andbuild awareness of the threat from cyberattack. This is often <strong>about</strong> changing theculture such that employees are alertto the risks and are proactive in raisingconcerns with supervisors.5 | <strong>Cyber</strong> <strong>security</strong>: <strong>it’s</strong> <strong>not</strong> <strong>just</strong> <strong>about</strong> <strong>technology</strong>© 2014 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network ofindependent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.All rights reserved. Printed in the U.S.A. The KPMG name, logo and “cutting through complexity” are registeredtrademarks or trademarks of KPMG International. NDPPS 264522