A New Approach to C*********ity

New Thinking to Enable a Stronger Organization

Let’s face it, droning on about impending doom to the organization: “if we don’t deploy resources (money and staff) to reduce our security risks now, then I can’t be held responsible …” goes down like a lead balloon. Whatever you say next is not listened to. Instead, the executive minds return to dealing with other issues or how to execute the next big plan. You will notice that even the title of this article couldn’t bring itself to use the word cybersecurity!

It’s time to change that with an approach that will open closed minds. After authoring the article on Resilience in the fall edition, I had one of those “why didn’t I think of this before?” moments, realizing that it was all in the language and the impact on the listener. It’s switching from the part of the brain that reacts to an amygdala attack to fostering being inspired by new possibilities.

This article is not about brain science; it’s about:

• Putting all actions in the context of strengthening the organization by changing the mindset to enable new possibilities.
• Creating a structure for low-cost execution with a holistic strategy and incremental actions.
• Executing actions related to avoidance, prevention, detection, and removal of disruptions to the goals.
Measuring and reporting improvement over time. Then, adapting to the evolving organization and changes that impact the goals for the next iteration.

Developing the Executive Language

This begins by using words like “strengthening the organization” and avoiding negative words such as “risk” and “threat avoidance.” I just read a guidance document that used the word “risk” 160 times, along with “vulnerabilities,” insider terms like “security posture,” and acronyms that interrupt the listener’s understanding. Look to see how well-documented resilience and security procedures support sales to differentiate from competitors, remove supply chain fears, etc. Just like privacy policies that no one reads, the security policy should be posted to identify the organization as a modern, powerful company. The same applies to obtaining insurance at lower rates, meeting legal and SEC requirements, and defending its reputation if supply chain vendors cause problems.

Lastly, specifically for ISE Magazine readership, although the focus here is on end-users, there are two difference-making services that could be unique client offerings for service providers. Offering the security services covered in my Assume Breach article (ISE spring edition and cybyr.com/assumebreach) means end-users can both potentially eliminate ransomware and save money by delegating responsibility and costs to service providers. This is exactly the kind of thinking that changes executive mindsets. (See Figure 1.)

Due to limited space, we can only provide the highlights of the approach here. It’s expanded on my website (cybyr.com/strengthening). The idea is to use the work to develop your own powerful, resilient organization (external cost = 0).

Creating a Holistic Strategy and Incremental Plan

To deliver on the promise, two documents are required:

1. A Holistic Resilience and Security Policy covering the scope of actions and the goals measuring the impact on the organization. Holistic here means every department and line of business, collaboration with all supply chains, including outsourcing, evolving over time.
2. The Plan of Action. This lists short-term actions to be undertaken by each department under your guidance. The execution of the plan will be either action completion or achieving measurable milestones. Its scope includes sales and marketing actions, legal, conformance and compliance, HR, etc., that strengthens the organization. The point is, of course, not to get overwhelmed by too many tasks at once and to observe measurable progress.

Much of this work will consist of interrogation of the organization’s departments to discover vulnerabilities and make agreed recommendations. This is one of the reasons that I wrote Cybyr-AI, my Expert Proactive AI Software to personalize and automate the process, make recommendations, and measure results. However, you may choose to do this yourself (external cost = 0) or with help from a consultant (like me!).

Executing the Actions in the Plan

This section breaks down the main tasks related to avoidance, prevention, detection, and removal of disruptions to the goals.

Avoidance and Prevention

Here are some basic actions to take and not to take.

Stay Connected with ISE Magazine 

Subscribe to our newsletters and magazine for the latest telecom insights, explore the current issue for in-depth features and strategies, and register for upcoming webinars to learn directly from industry leaders.