Here are 8 possible ways you can be inviting a cyberattack
1. Invisible systemic risk
Businesses, Organizations and Individuals make decisions every day that negatively impact their security readiness: for example, refusing to shut down a server for proper patching or choosing to keep working on old hardware and software to save budget. These unreported decisions lead to a false sense of security and increase the likelihood and severity of an incident.
2. Cultural disconnect
Non- IT folks still see Cybersecurity as something that is “just there,” like air or water. This means it isn’t considered a part of business decisions.
3. Throwing money at the problem
You can’t buy your way out — no matter what you spend, you won’t be perfectly protected against cyberattacks. By trying to stop every risky activity, you will likely damage your organization’s ability to function.
4. Security as “defender”
If security officers are treated as (and act as) defenders of the organization, it creates a culture of no. For example, they might block the release of a critical application due to security concerns without considering the business outcomes the application supports.
5. Broken accountability
Accountability should mean that a decision to accept risk is defensible to key stakeholders. If accountability means that someone will get fired if something goes wrong, no one will engage.
6. Poorly formed risk appetite statements
Organizations create generic high-level statements about their risk appetite that don’t support good decision making. Avoid promising to only engage in low-risk activities, as this can create invisible systemic risk
7. Unrealistic social expectations
When a headline-grabbing security incident happens, society just wants heads to roll. While this isn’t fair, it’s the result of decades of treating security as a black box. No one understands how it really works and as a result, when an incident does occur, the assumption is that someone must have made a mistake.
However, society is not going to change until organizations and IT departments start treating and talking about security differently.
8. Lack of transparency
Some boards and senior executives simply do not want to hear or acknowledge that security isn’t perfect. Board presentations are filled with good news about the progress that has been made in security, with little or no discussion about gaps and opportunities for improvement
