Most organisations, regardless of size or sector, would be hard pushed to call their IT security department \u2018popular\u2019. The general feeling is these tools, together with those of us that implement and maintain them, if given their way impede productivity, hamper technological innovation and inhibit organisational flexibility. In short, some (many?) don\u2019t see us adding value.<\/p>\n
This feeling is compounded each time cyber-criminals prove publically that they now have the financial strength and skill to beat many enterprise IT security solutions.<\/p>\n
Time to give up and go home? No way. But we must face the truth: we are developing an image problem. One that has also faced those promoting health and safety (H&S) or human resources (HR).<\/p>\n
The \u2018what\u2019s in it for me?\u2019 culture<\/strong><\/p>\n In recent times, both H&S and HR have adopted a \u2018carrot and stick\u2019 approach to effect a positive change in their image.<\/p>\n Health and safety folks, after establishing a grounded position as the butt of almost all office jokes, sought to get closer to workers in order to understand how to develop processes and rules that worked for everyone. Since then, a lot of time and money has been spent on employee education and engaging internal marketing campaigns. As a result, many construction companies, in particular, now use their safety record to as a vehicle through which they can promote their brand externally.<\/p>\n On the other hand, HR professionals recognised they could harness the tools of our hyper-connected digital age and make them work in their favour. They have championed flexible working, for example, and embraced mobile technologies, using both to recruit new talent as well as ensuring that current staff can work in ways that suit them. These changes have improved the image of HR almost immeasurably. They are now an enabler.<\/p>\n A new face for IT Security<\/strong><\/p>\n So what can we learn from those guys? Firstly, we have to accept that we have to change how we operate. If we just focus on security and not on other business drivers, the messages will be lost.<\/p>\n If we try and dictate terms to users, or lock-down networks en-masse, operational efficiency will suffer, resulting in festering discontent and the loss of key talent from the business.\u00a0 At the same time, we also need to help our organisations understand that focusing blindly on workers\u2019 digital user experience can have serious consequences. Yes, this new culture can make workers more productive, but the flood of data breach headlines over the last couple of years proves beyond any doubt that new bad habits will catch up with businesses at some point, probably sooner rather than later.<\/p>\n To be successful IT Security need to be seen as enablers rather than hinderers.\u00a0 Rather than reactively trying to stop or descope the work of other departments, IT security needs to be part of the team that delivers new capabilities but in a secure way.\u00a0 Even proactively suggest new, more productive, working practices based on the latest solutions from IT security vendors.<\/p>\n For example, we need to work closely with HR to better support mobile workers. If we can understand the types of mobile devices staff want to use and how they\u2019re using them, we can provide a list of approved devices and solutions. In fact, to make the process more proactive, each department should appoint an IT liaison representative.<\/p>\n Then the two departments can work together to agree appropriate user policies for the organisation. If staff chose to break those rules, it then becomes an HR issue, not just an IT security issue. On a more positive note, this union can really add value too, enabling a \u2018chose-your-own-device\u2019 policy that will appeal to everyone. Once we\u2019ve agreed the parameters that will govern access to the corporate network, and then engagement with communications department needs to swing into action, turning out regular campaigns to educate and engage staff on the benefits delivered.<\/p>\n If a communications department is being given funding to design internal campaigns that champion benefits of a firm\u2019s carbon emissions strategy, surely the same should be happening on the issue of cyber security. Ford understands this; \u2018cyber security Steve\u2019 is a campaign that the motor company is now using to educate employees in online safety.<\/p>\n We\u2019re all on the same team<\/strong><\/p>\n None of us wants to suffer accusations of \u2018cyber security gone mad\u2019, in the way that the health and safety industry has been forced to endure.\u00a0 Ultimately, even if we are to improve the perceptions of IT security, everyone from the CEO to the shop-floor must accept that we\u2019re all responsible for cyber-security. Only by working together will we be able to achieve success.<\/p>\n","protected":false},"excerpt":{"rendered":" Most organisations, regardless of size or sector, would be hard …<\/p>\n","protected":false},"author":2,"featured_media":363,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-361","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"yoast_head":"\n