Cybercreeps and Cybercrats (Part 1)
Part 1 – What Is Cybersecurity and why should you care?
I think of myself as a maker. Nothing pleases me more than when I deliver to the user and hear “Oh, this is better.” Even a simple macro, to know I’m making somebody’s job easier and their product better, that’s a pleasure and the reason I do this work. I confess I’m not as patient as I should be with the infrastructure guys who are expected to magic my new server into existence, and to know its specs before I tell them. And nothing is more tedious than those guys who are sent to slow me down, the system administrators with their processes and paperwork; and, oh, the security restrictions. Yes, those are the worst, from those blind nerds with their Sonicwall appliances, their NIST frameworks and their RSA tokens, heaven preserve us.
Well yes, it’s all that could, were we to ignore the IT security experts. They’re trying to keep us safe when the lowlife, slime-suckers besiege us from all sides. To call them “bad actors”, as the field’s jargon has them, is too dignified. Those cybercreeps who take from us through phishing scams, ransomware, and identify theft; who steal companies’ intellectual property and reputation; and who block all kinds of institutions’ operations with denial of service attacks, just to scratch the surface. The promise of the internet is to bring us together but that’s inhibited by the hoops we now have to jump through to make a legitimate connection. It’s not safe out there anymore and these days we need to listen carefully when someone who puts CISSP in their signature block speaks. From the hallways at Davos to the leaning in Columbia Women in Technology, the hot topic is cybersecurity, because – much as I hate it – this stuff is important.
Cybersecurity is one of those elephants that turn us into blind men. We each tend to think of it from one angle: it’s password protection, it’s spam filters, it’s the firewall. Technopedia defines it as “preventative methods used to protect information from being stolen, compromised or attacked”. That’s a little vague. The US Department of Homeland Security implies that any kind of cybercrime, including distribution of child pornography, falls under this rubric; but that seems pretty broad. We’re trying to keep the thieves outside of our homes, not clean up the streets too. I like the definition provided by the University of Maryland University College which says that cybersecurity “focuses on protecting computers, networks, programs and data from unintended or unauthorized access, change or destruction”.
As an IT manager, that may still be too vague to be helpful. To start breaking it down, you’re not thinking fully about cybersecurity if you’re not including:
- Network security – all those firewalls, security appliances and user authentication methods that keep the hackers and theives out of your network, plus the tools and their configurations that monitor and encrypt data to keep it safe inside your network or in transit. This is a huge, constantly evolving area requiring dedicated staff.
- Application security – just because someone is inside your network, or even a given application, that doesn’t mean they should be able to read or update all of its data.
- Physical security of IT systems – criminals can compromise your systems, but so can fickle fate. Your security depends on measures that will keep you up and running regardless of fire, flood, earthquake or terrorist bomb. I work in downtown Manhattan where we’ve had all of the above in recent memory, but these things can happen anywhere. Have backups, business continuity plans and disaster recovery sites.
- Policy and education – it’s not enough to have the hardware and software in place because an uninformed user can always hand the keys to a con man. You need to have comprehensive, reasonable and not unduly onerous policies and procedures, and users sufficiently sophisticated and aware that they will reliably apply them. Chances are human factors are your greatest vulnerability. This is how you deal with that.
There’s one more thing you should know about cybersecurity. By some reports there are over 200,000 American jobs open in the field, and Cisco claims there are a million jobs unfilled globally. Forbes calls it a “Labor Epidemic“. So forget Data Science, that’s so 2015. If you’re choosing a career in 2016, I’ll bet you can find something to appeal in this list from the National Initiative for Cybersecurity Careers and Studies (NICCS). And if you think you might need more people to protect your systems (and you probably do), start hiring sooner rather than later because it’s not going to get easier to find the experts you need.
In part 2, I’ll talk about how working with public sector organizations can enhance your security.
« I Don’t Know Much About Strategy… Cybercreeps and Cybercrats (Part 2) »
