Why large organizations still struggle with decade-old security problems — and how to fix them
I have been involved with information security matters for over 20 years and started writing regularly on the topic in 2015.
Talking to CISOs, CIOs, CEOs and their teams as part of my day-to-day field work as consultant, I was horrified by what I was seeing in too many large corporates in terms of security maturity levels and the actual problems some were still struggling with — something that goes way beyond anecdotal evidence and is at the heart of survey after survey every year.
After all, information security good practices have been well established for over 20 years and many industry bodies have been promoting them and evolving them throughout that period.
Why is it that large firms which have had fully functioning information security teams in place all that time, and have spent — collectively — hundreds of millions on the topic if not more on cyber security, are still struggling today with issues — such as patch management — which should have been on their radar for over 10 years?
There is truly a cyber security lost decade for many between the CodeRed, Slammer and Blaster outbreaks of 2001–2003 and the Wannacry and Not Petya attacks of 2017.
By failing to get the basics right in terms of security during that time while continuing to engage in massive cloud-driven business transformation programmes which have turned the enterprise into a truly borderless hybrid, many large firms have dramatically increased their level of exposure to cyber threats. And now the acceleration of the digital transformation emboldened by the COVID crisis — which is also creating unprecedented budgetary tensions — is making things even more complex. And politicians and regulators are now involved as the GDPR and CCPA have shown us over the past few years.
At Board level, the “when-not-if” paradigm around cyber-attacks has taken root, but it creates fundamentally different dynamics for CISOs and CIOs, as the focus shifts radically from risk and compliance towards execution and delivery, often in exchange of massive investments around security (at least pre-COVID).
To embed those different dynamics around cyber security and make true progress, large organisations must stop thinking of the topic in pure technological terms, look back and address urgently the underlying cultural and governance issues that have been the true roadblocks of that “lost decade”.
This is the theme I have been developing over the past 5 years through my contribution to the Corix Partners blog and every year since 2017, I have been releasing a selection of key articles in print, grouped by themes, this year with a full section on the COVID-19 crisis and its implications for security leaders.
I am delighted to launch the 2020 edition today, and you can now buy it here on Blurb. I hope readers will find its content thought-provoking and that it will help some move forward.
JC Gaillard
14th September 2020
In this 2020 edition, we are including in Appendix the key findings of a piece of leading quantitative research driven in Q3 2019 by The Security Transformation Research Foundation (with Vincent Viers): “Cyber Security: A Look Across Two Decades” : The semantics analysis of the content of 17 annual “Global Information Security Surveys” from leading firm EY, spanning the period 2002–2018.