Breaking down the mystery of organisation goal for cyber security vs the journey to get there!

In all companies, I have been hired to at least once carry out infrastructural augmentation or deploy a SIEM/cyber solution, a common pattern often emerges. On a ‘paper’ declaration through Statements of Work (SOWs) or contracts, it would be purported that these organisations are being pushed by their boards, their CISOs or regulatory legislative requirements to enhance their cybersecurity posture. More often than not, this is slightly off from reality. While the teams I work with and drive commitment from are excited to make strides, they are often met with resistance (i.e. walls or silos) from other departments. It’s a major barrier of resistance that we need to start chipping away at in this era of persistent cyber threats.

This talk looks to have a deep dive and honest chat that both Senior executives should be having as well as leaders of teams creating resistance. We can talk until the midnight candle burns about communication, but often communication exists. What generally happens from experience is one team (mainly cyber led) is responding to a request from Senior leadership or boards and other teams may be taken by surprise.

To tackle this, fostering communication across the departments is very important. Aim at having regular meetings and keep channels of communication open between the teams. This way, it will not only build a common understanding of the goals of cyber security but bridge the existing gaps. Leadership is key here; setting up the vision and regulatory requirements of the board with each team’s objectives can eliminate any confusion over what their roles are.

Another area that will need to be addressed is that of assigning cyber security champions. This particular one ensures that the involvement of key personnel within each department in advocating for cyber security strategies is not just encouraged but championed. The third concept is unified risk management. When benefits to the organization in general through shared responsibility to safeguard the organization against cyber threats are communicated clearly, then the whole organization is set to benefit.

Once cyber security achievements have been duly met through teamwork, departments need to be recognized and awarded so that the culture of collaboration is instilled. Moreover, having a shared vision statement is important. The provision of an all-inclusive vision that outlines the collective targets of all stakeholders in the process of enhancing security upliftment not only inspires but also unites them.

Finally, an enabling feedback and continuous improvement through reliable mechanisms might have to be put in place. These channels let teams keep voicing their concerns and recommending improvement in the ongoing cyber security journey; always, hence, the process keeps evolving.

So how do we achieve breaking down these barriers in the current threat climate of cyber security? This is the burning question that constitutes the very purpose of this talk. By implementing the strategies, we can break down the walls between teams and foster a much more unified and resilient ‘whole’ cyber security approach for the organization.