{"id":14977,"date":"2014-07-10T16:13:54","date_gmt":"2014-07-10T16:13:54","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=2217"},"modified":"2019-11-15T07:16:15","modified_gmt":"2019-11-15T12:16:15","slug":"who-is-really-to-blame-for-cybersecurity-breaches","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/who-is-really-to-blame-for-cybersecurity-breaches\/14977\/","title":{"rendered":"Who is Really to Blame for Cybersecurity Breaches?"},"content":{"rendered":"

The vast majority of IT organizations today have a big problem: the rest of the company considers them to be 100% responsible for cybersecurity.\u00a0 Holding them accountable for some aspects of cybersecurity makes sense, but they certainly can\u2019t be considered\u00a0wholly responsible<\/em>.\u00a0 In fact, IT staff are really in about the same position as police officers:\u00a0while cops can discourage criminals and thwart some crimes, they certainly can\u2019t be considered responsible for every successful crime that occurs. Nor is it their fault that so many people leave their doors (or mobile endpoints) unlocked and become unwitting targets. And yet, organizations very often fire someone in IT, if not the CIO, when breaches occur.<\/p>\n

\n<\/p>

Security isn\u2019t necessarily a hard problem to solve. If IT had complete control over the organization, they could easily ensure there were never any breaches: dig a moat around the company, throw in a hundred alligators and prohibit anything or anyone from coming in or going out. It\u2019s simple, albeit medieval.<\/p>\n

Of course businesses cannot function with this sort of \u201cisolation solution\u201d. It\u2019s impossible for any enterprise to succeed today without multiple ingress and egress points for people, information and communication. And with all those moving parts, there are many things IT can\u2019t control. One solution \u2013 come up with an equation that helps gauge the degree IT can or should be held accountable for cybersecurity.<\/p>\n

Insurance companies have created good models for this: when examining a traffic accident for example, they determine precisely what percentage of blame each element involved in the crash is responsible for. The key factors might include: weather (5%), worn tires (12%), the driver\u2019s inexperience (17%) and the pig in the intersection (66%). If we actually applied this sort of formula to any given breach of a company, we would probably have to conclude that IT is less than 20% responsible<\/em>.\u00a0<\/p>

IT departments are like police: they can prevent bad things, but only some of \u2019em.<\/p>Tweet<\/a><\/blockquote>\n

A list of other factors to consider when assessing fault in a cyber breach include:<\/p>\n