When I first entered the cybersecurity market in 2003, I’d already been working in the IT industry for about 16 years in storage, networking, and telecommunications previously. By the early 2000s, all three sectors had moved on from bits and bytes to focusing on how each technology could help organizations meet their business goals. Oh sure, we still talked speeds-and-feeds, but we led with things like business agility, productivity, and cost cutting. The technology was a means to an end rather than an end in itself.
When I got to the cybersecurity industry, I was surprised by what I saw. Unlike other areas of IT, cybersecurity was still deep in the weeds, focused on things like IP packets, application protocols, and malicious code. In other words, cybersecurity remained a “bottom-up” discipline as the cybersecurity team viewed the world from networks and devices “up the stack” to applications and the business.
Fast forward to 2019: The world has become a lot more dangerous based upon a wide variety of sophisticated threats. In the meantime, IT has expanded horizontally, driven by mobility, IoT devices, SaaS, cloud-based workloads, etc., thus greatly expanding the attack surface. In the meantime, business executives now recognize 2 important realities: 1) Most of their business processes are anchored by IT, and 2) A cyber-attack and/or data breach could happen at any time and lead to devastating consequences.
In the enterprise market, business executives now “get it,” and are all in on cybersecurity. For example:
In general terms, this is a good thing for cybersecurity professionals and the industry at large as it equates to more money, resources, focus, etc. As business managers become more engaged with cybersecurity, however, this focus must be accompanied by a major philosophical shift. Business people don’t care about IP packets, buffer overflows, or encryption, they care about protecting critical assets and maintaining ongoing business operations.
Based upon this fundamental and ongoing change, I believe that large organizations must embrace a “top-down” mentality toward cybersecurity management. Top-down cybersecurity starts with protecting the business mission, objectives, and processes and then aligns these priorities with the right controls and monitoring “down the stack” (i.e., the applications, servers, networks, and data/storage that support the business).
I’ll be the first to admit that top-down cybersecurity isn’t new – leading CISOs have pushed this type of agenda since CISOs were first hired. Nevertheless, I find that many organizations talk the talk, but can’t walk the walk. For example,
Cybersecurity has become an overwhelming task where few organizations have the resources, skills, or time to keep up with the ever-growing workload. Therefore, CISOs must focus resources and energy on protecting critical assets, business processes, and IT initiatives. This is the foundation of top-down cybersecurity.
A few closing thoughts:
Jon Oltsik is an ESG senior principal analyst and the founder of the firm’s cybersecurity service. Read more ESG blogs here.
