{"id":44582,"date":"2022-06-27T04:51:48","date_gmt":"2022-06-27T08:51:48","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?post_type=emagazine&#038;p=44582"},"modified":"2022-07-27T06:34:11","modified_gmt":"2022-07-27T10:34:11","slug":"cybersecurity-new-team-sport","status":"publish","type":"emagazine","link":"https:\/\/www.kaspersky.com\/blog\/secure-futures-magazine\/cybersecurity-new-team-sport\/44582\/","title":{"rendered":"Why cybersecurity is the new team sport"},"content":{"rendered":"<p>The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little.<\/p>\n<p>The result is, we\u2019re losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer \u2013 not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport.<\/p>\n<h2>The futuristic wild west of IT<\/h2>\n<p>When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne \u2013 refrigerated because the IT team would often share the room with servers that need to be kept cool \u2013 knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy.<\/p>\n<p>Today, we\u2019re in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist \u2018gun slingers\u2019 \u2013 in the form of CISOs \u2013 have the IT administrator\u2019s security responsibilities. Each tries their best to cope with the onslaught of potential threats \u2013 anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn\u2019t.<\/p>\n\t\t\t<div class=\"c-promo-product\">\n\t\t\t\t\t\t<article class=\"c-card c-card--link c-card--medium@sm c-card--aside-hor@lg\">\n\t\t\t\t<div class=\"c-card__body  \">\n\t\t\t\t\t<header class=\"c-card__header\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<h3 class=\"c-card__title \"><span>Endpoint security and a balloon<\/span><\/h3>\n\t\t\t\t\t\t\t\t\t\t\t<\/header>\n\t\t\t\t\t\t\t\t\t\t\t<div class=\"c-card__desc \">\n\t\t\t\t\t\t\t<p>Why you should step up your endpoint protection in one pop.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"c-card__aside\">\n\t\t\t\t\t<a href=\"https:\/\/www.kaspersky.com\/blog\/secure-futures-magazine\/explaining-endpoint-detection-response\/43657\/\" class=\"c-button c-card__link\" target=\"_blank\" rel=\"noopener nofollow\">Watch video<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<\/article>\n\t\t<\/div>\n\t\n<h2>Start-up mentality not all it\u2019s cracked up to be<\/h2>\n<p>\u201c<a href=\"https:\/\/en.wikipedia.org\/wiki\/Fail-fast\" target=\"_blank\" rel=\"noopener nofollow\">Fail fast<\/a>\u201d and \u201c<a href=\"https:\/\/www.explainxkcd.com\/wiki\/index.php\/1428:_Move_Fast_and_Break_Things\" target=\"_blank\" rel=\"noopener nofollow\">move fast and break things<\/a>\u201d are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don\u2019t worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without <a href=\"https:\/\/www.wired.co.uk\/article\/phone-hacking-mollitiam-industries\" target=\"_blank\" rel=\"noopener nofollow\">considering if it will breach compliance<\/a>.<\/p>\n<p>Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn\u2019t understand the need for rapid reaction to combat the latest advance in \u2018<a href=\"https:\/\/www.forbes.com\/sites\/leemathews\/2017\/07\/27\/criminals-hacked-a-fish-tank-to-steal-data-from-a-casino\/?sh=3f7a24f432b9\" target=\"_blank\" rel=\"noopener nofollow\">dark tech<\/a>.\u2019<\/p>\n<h2>We\u2019ve seen this challenge before<\/h2>\n<p>Up to now, I\u2019ve described a futile, dystopian, \u2018<a href=\"https:\/\/en.wikipedia.org\/wiki\/Mad_Max\" target=\"_blank\" rel=\"noopener nofollow\">Mad Max<\/a>\u2018 world. But I think the battles CISOs fight today are our history, not of our future.<\/p>\n<p>Companies, and those in cybersecurity, often call their critical data and intellectual property the \u2018crown jewels,\u2019 referencing the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Crown_jewels\" target=\"_blank\" rel=\"noopener nofollow\">ceremonial treasures acquired by English kings and queens<\/a>. Those crown jewels are protected by thick walls, with guards and few entry points \u2013 like how IT administrators guarded our data back in the 80s.<\/p>\n<blockquote><p>Today\u2019s cyber \u2018crown jewels\u2019 are distributed across systems and even continents. A lone hero can no longer protect these assets. We need a team of heroes.<\/p>\n<\/blockquote>\n<p>CISOs are inevitably \u2018outgunned,\u2019 under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we \u2018fight the good fight\u2019 and win?<\/p>\n<p>Again, history has answers. Early 1900s business theorist <a href=\"https:\/\/en.wikipedia.org\/wiki\/Harrington_Emerson\" target=\"_blank\" rel=\"noopener nofollow\">Harrington Emerson<\/a> is sometimes paraphrased, \u201c<a href=\"https:\/\/twobrainbusiness.com\/methods-vs-principles\/\" target=\"_blank\" rel=\"noopener nofollow\">Methods are many, principles are few. Methods may change, but principles never do<\/a>.\u201d So let\u2019s go back to first principles.<\/p>\n<h2>We\u2019re stronger together<\/h2>\n<p>Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth.<\/p>\n<p>Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live.<\/p>\n<p>Settlements collaborated \u2013 sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored \u2018everyone for themselves,\u2019 most joined together for the greater good.<\/p>\n<p>Charles Darwin said, \u201cIt is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed.\u201d History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history.<\/p>\n<h2>COVID-19: Each taking on a little<\/h2>\n<p>During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society.<\/p>\n<p>Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up.<\/p>\n<p>During the pandemic, countries teamed up, sharing information about infections \u2013 different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn\u2019t stop there \u2013 sharing goes on, so vaccines can be tweaked to ensure continued efficacy.<\/p>\n<p>Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team \u2013 not just within one organization, but within a global network, openly sharing intelligence and insight.<\/p>\n<blockquote><p>Imagine a world where, when a CISO identifies an incident, they send an update to a system that tells CISOs on every continent what to look for.<\/p>\n<\/blockquote>\n<p>On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security.<\/p>\n<p>This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since <a href=\"https:\/\/en.wikipedia.org\/wiki\/September_11_attacks\" target=\"_blank\" rel=\"noopener nofollow\">September 11, 2001<\/a>.<\/p>\n<p>This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap \u2018war stories\u2019 under the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Chatham_House_Rule\" target=\"_blank\" rel=\"noopener nofollow\">Chatham House rule<\/a>: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports.<\/p>\n<p>We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange \u2013 it doesn\u2019t have to be that way.<\/p>\n<p>History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When IT security is like a futuristic wild west, lone gunslinging heroes have little to offer cybersecurity\u2019s bigger picture. But history has a solution.<\/p>\n","protected":false},"author":2708,"featured_media":44596,"template":"","coauthors":[4346],"class_list":{"0":"post-44582","1":"emagazine","2":"type-emagazine","3":"status-publish","4":"has-post-thumbnail","6":"emagazine-category-enterprise-cybersecurity","7":"emagazine-category-leadership","8":"emagazine-category-threat-intelligence","9":"emagazine-tag-ciso","10":"emagazine-tag-cyberattacks","11":"emagazine-tag-data-security"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/secure-futures-magazine\/cybersecurity-new-team-sport\/44582\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/secure-futures-magazine\/cybersecurity-new-team-sport\/26667\/"}],"acf":[],"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/emagazine\/44582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/emagazine"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/emagazine"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/2708"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/44596"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=44582"}],"wp:term":[{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/coauthors?post=44582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}