Cyber Defense eMagazine March Edition for 2022

internet, etc. How much training is sent to the employees? Is it completed, and is it a priority? Do the
employees understand the risks associated with not following proper cybersecurity processes? And is
the example of being a good cybersecurity steward exemplified from the top down—does it begin at
senior levels within the company? This is often the best way for culture to be impacted. A great example
of how senior levels can set the example can be taken from Netflix and the implementation of their leave
policy, which is to say they have no complex leave policy. As long as people complete their work and
don’t leave anyone else in the lurch, employees may take leave when and where they’d like. Employees
were initially disbelieving; however, when Reed Hastings, the chairman of Netflix, and the leadership staff
posted photos of their respective vacations, it changed the culture quickly because everyone could see
the boss was embracing the company’s approach to leave. This leave approach certainly wouldn’t work
in all organizations, but that is beside the point. It’s an example of how leaders in an organization can
positively influence their employees.
With predictions that threat actors will weaponize operational technology environments to cause human
casualties by 2025, and with the influx of over-the-air updatable programmable logic controllers and
continued malicious attacks on our SCADA networks, it’s more imperative than ever to learn from and
apply the cybersecurity lessons of the past. We are starting to see more broad negative effects of
breached or attacked systems on administrative networks today. Not only may companies have to stop
operations temporarily, but entire supply chains can be affected, which ultimately can affect the entire
country.
As IT and cybersecurity professionals, it's our duty and challenge to push industry executives to prioritize
cybersecurity as a high-interest item in the funding drills corporations exercise yearly. We must motivate
them to continue to bake-cybersecurity-in from the initial design and conception phases of budgeting
versus tacking it on at the end of the process. To prevent cyber attacks such as those on Sony in 2014
or more recent examples such as Colonial Pipeline or JBS meat processing, we must use all the tools at
our disposal and more effectively apply the cybersecurity lessons of the past. This means not only
budgeting and applying funds to cybersecurity but also cultivating strong cybersecurity processes via
three main components: people, culture and technology. As Gartner pointed out, “99% of vulnerabilities
exploited will continue to be ones that teams knew existed.”
Cyber Defense eMagazine – March 2022 Edition 45
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.