Cyber security it’s not just about technology

02The five most common cybersecurity mistakesTo many, cyber security is a bit of a mystery. This lack of understanding has createdmany misconceptions among management about how to approach cyber security.From our years of experience, we have seen the following five cyber securitymistakes repeated over and over – often with drastic results.1Mistake: “We have to achieve100 percent security”Reality: 100 percent security is neitherfeasible nor the appropriate goalAlmost every airline company claims thatflight safety is its highest priority whilerecognizing that there is an inherent risk inflying. The same applies to cyber security.Whether it remains private or is madepublic, almost every large, well-knownorganization will unfortunately experienceinformation theft.Developing the awareness that100 percent protection against cyber crimeis neither a feasible nor an appropriategoal is already an important step towardsa more effective policy, because it allowsyou to make choices about your defensiveposture. A good defensive postureis based on understanding the threat(i.e., the criminal) relative to organizationalvulnerability (prevention), establishingmechanisms to detect an imminent oractual breach (detection) and establishinga capability that immediately deals withincidents (response) to minimize loss.In practice, the emphasis is oftenskewed towards prevention – theequivalent to building impenetrablewalls to keep the intruders out. Onceyou understand that perfect securityis an illusion and that cyber securityis “business as usual,” you alsounderstand that more emphasis must beplaced on detection and response. Aftera cyber crime incident, which may varyfrom theft of information to a disruptiveattack on core systems, an organizationmust be able to minimize losses andresolve vulnerabilities.2Mistake: “When we invest in bestof-classtechnical tools, we are safe”Reality: Effective cyber security is lessdependent on technologythan you thinkThe world of cyber security is dominatedby specialist suppliers that sell technicalproducts, such as products that enablerapid detection of intruders. These toolsare essential for basic security, andmust be integrated into the technologyarchitecture, but they are not the basis ofa holistic and robust cyber security policyand strategy. The investment in technicaltools should be the output, not the driver,of cyber security strategy. Good securitystarts with developing a robust cyberdefense capability. Although this isgenerally led by the IT department, theknowledge and awareness of the enduser is critical. The human factor is andremains, for both IT professionals andthe end user, the weakest link in relationto security. Investment in the best toolswill only deliver the return when peopleunderstand their responsibilities to keeptheir networks safe. Social engineering,in which hackers manipulate employeesto gain access to systems, is still one ofthe main risks that organizations face.Technology cannot help in this regardand it is essential that managers takeownership of dealing with this challenge.They have to show genuine interest andbe willing to study how best to engagewith the workforce to educate staff andbuild awareness of the threat from cyberattack. This is often about changing theculture such that employees are alertto the risks and are proactive in raisingconcerns with supervisors.5 | Cyber security: it’s not just about technology© 2014 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network ofindependent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity.All rights reserved. Printed in the U.S.A. The KPMG name, logo and “cutting through complexity” are registeredtrademarks or trademarks of KPMG International. NDPPS 264522