Current Cyber Security Status
On December 2018, Forbes posted an article, predicting how Cyber Security will be in 2019. With various cases like Media Prima being hit by ransomware, or Marriott Hotel’s series of data breaches, one can easily see how important cyber security will be in the coming future.
The evolution of Security Skills
Today, Security is at the top of mind for many companies, especially in this digital driven era. Many companies rely on technology to run their businesses. Basically, Cyber Security skills has evolved from “good to have” to “must have”.
Security is a growing Business Imperative
With the increase of investment in technology by companies, so is the importance of Cyber Security. To put it this way, the more convenience the technology brings, the more vulnerable it will be. Companies that invested heavily on technology knows this theory and therefore starting to treat Cyber Security as a standalone discipline and putting it as high priority objectives.
New training is needed to close skill gaps
With the increasing awareness of companies on Cyber Security, the demand for skilled Cyber Security Professional increases exponentially, estimated 37% per year growth in job demand to be exact. Some company compensate the lack of supply by partnering with Cyber Security firms or upskilling their existing workforce. 60% of companies send their workforce for Cyber Security training and 48% of them pursue for certifications.
Security skills need to be deep and wide
For many of this companies (between 18% to 32%), knowing is not enough. There are a wide range of skills that these companies are expecting from their Cyber Security Professionals. They are expecting a significant improvement from their existing security expertise and their new aim for their security goal is not to be impenetrable, instead is to proactively find cracks in their armour before attackers discovers it.
Download the whitepaper to read more about the evolution of cyber security skills.
Building a Culture of Cyber Security
Having a professional Cyber Security expert is not enough, it takes more than that to protect a company’s Cyber Security. As what Warren Buffett said, Cyber Security is the number one issue facing humanity. Therefore, Cyber Security is not just IT’s problem, it’s executive-level problem. Uber, Target, Equifax, Dyn are just some of the name that get affected by Cyber Attack. For that, Company need to build a corporate culture that take Cyber Security seriously.
There are few principles to follow in order to build a cyber security culture in your company.
PRINCIPLE 1: INTEGRATE CYBER SECURITY INTO YOUR BUSINESS STRATEGY
A company’s leader should measure the value of Cyber Security accurately and that message need to convey to everyone in the company. It should be one of the mission-vision of the company to keep the company safe from Cyber Attack. As you may probably know now, it’s impossible to have an impenetrable network, the only think that one can do is to make sure everyone knows about the important of Cyber Security and practice the steps to prevent it happening. to show a good example, J.P Morgan Chase, a Finance powerhouse, double their Cyber Security budget to half a billion dollars and Microsoft plan to invest $1 billion annually on cyber security research and development.
PRINCIPLE 2: YOUR CORPORATE CULTURE SHOULD REINFORCE A CULTURE OF CYBER SECURITY
Many companies are starting to have CISO, that is Chief information Security Officer. Previously, CISO report to Chief Information Officer (CIO), but now, CISO direct report to CEO in order to improve efficiency. That is because CIO main focus usually is on efficiency and accessibility, whilst CISO main focus is to identify the security vulnerability. Booz Allen Hamilton, a military and business management consulting firm, even have their CIO report to CISO, in order to show the importance of cyber Security.
PRINCIPLE 3: YOUR EMPLOYEES ARE YOU BIGGEST RISKS
Believe it or not, research shows that IT employees are actually the most like person to engage in cyber security risk. This shows that training for every employee who have access to the network is crucial. Even the most basic anti-phishing program will bring 7-fold return of investment for the company. For that, never underestimate the training for your employees, and don’t just limit to only your IT guys, it should be a compulsory course for all your employees who have access to your network.
PRINCIPLE 4: DETECT, DETECT, DETECT
It is important to know that, detecting is more efficient that preventing. Many companies focus more on preventing instead of detecting. Yes, prevent is crucial, but detect is important as well. It is advisable to frequently conduct penetration testing (Pentest) to discover security vulnerability. Only with that, one can know what is wrong and what will go wrong. Pentest is considered as white hacking, that is hacking a system legally. A very famous exercise to conduct Pentest is the “red/blue team” exercise. The red team will be those pentest experts whilst blue team will do their best to detect and defense.
PRINCIPLE 5: COLLECT WHAT YOU NEED, SHARE ONLY WHAT YOU HAVE TO
Often time, data breach happens on those businesses that have no need for the data at the first place. It’s like keeping something you don’t need that might bring you trouble. Manager often give order to collect as much data as possible, without knowing exactly how to use those data and how to use it the right way. Sharing data is also a problem leader need to take serious action on. Data shared online are the easiest to breach, since it is up there for anyone to grab. Therefore, sharing only the necessary is also something a company need to incorporate into their culture.
Download the whitepaper to read more on how to build a cyber security culture.
Final Verdict….
All and all, human factors are the weakest point in cyber security. It’s that one simple click on the link that result in catastrophic disasters. Therefore, it is crucial for a company leader to send out the message to whole company, that cyber security is one of the major focus of the company and should be taken seriously. Right training for the right users is important as well, so that each and every one of them knows their role in protecting the company’s security.
Learn more about Comptia Cyber Security Courses
