Three mistakes companies make in cybersecurity
Throughout my consulting career, I have had the opportunity to guide numerous companies through challenging situations arising from inadequate cyber maturity. While each case presented its unique challenges, I consistently observed three major mistakes that companies tend to make when approaching cybersecurity. These mistakes, if left unaddressed, can leave organizations vulnerable to significant risks and potential cyber threats. By understanding and rectifying these mistakes, companies can strengthen their cybersecurity posture and mitigate potential damage.
Mistake 1: Relying Solely on Compliance-Focused Programs
One common mistake is relying solely on compliance-focused security programs, which prioritize meeting regulatory requirements such as PCI DSS, HIPAA, SOC 2, and ISO 27001. While compliance is important, it alone does not provide comprehensive protection against cyber threats. This approach often leads to a false sense of security and reactive measures that only address known risks and vulnerabilities. In today’s ever-evolving threat landscape, this approach falls short as cybercriminals constantly develop new attack methods. Compliance-focused programs are fragmented and do not adapt well to the changing nature of cyber threats. Organizations need a proactive and comprehensive security strategy that goes beyond compliance to effectively defend against evolving threats.
Mistake 2: Treating Security as Solely an IT Problem
Treating cybersecurity as solely an IT problem is another mistake that fails to recognize it as a business risk requiring board-level oversight. Cybersecurity impacts the entire organization and extends beyond technical aspects. Breaches can result in substantial financial losses, reputational damage, and loss of trust. Viewing cybersecurity as solely an IT issue leads to siloed thinking, inadequate investment allocation, and a lack of accountability at the highest levels. It overlooks the importance of cross-functional collaboration, cultural change, and non-technical factors such as employee training, incident response planning, and third-party risk management.
Mistake 3: Thinking a Penetration Test Implies Security
A misconception is assuming that conducting a penetration test guarantees complete security. While penetration testing is valuable for identifying vulnerabilities, it does not provide a comprehensive solution on its own. Organizations often rely solely on penetration testing without addressing other critical aspects of cybersecurity. It offers a snapshot of security at a specific time, but cannot account for emerging threats or ongoing changes. Robust security requires a layered approach, including regular assessments, vulnerability management, training, incident response planning, and continuous monitoring. Recognizing the limitations of penetration testing and implementing a comprehensive security program helps protect against evolving threats and enhances overall security.
To address these challenges, organizations must adopt a holistic approach to cybersecurity. Indeed, I first considered this to be a fourth mistake for the list but see it more as a method. It should be treated as a business problem and an enterprise-wide risk. It also must align with the business objectives of the company. This approach involves integrating regulatory requirements into a broader security strategy and engaging the entire organization, including the board of directors. By recognizing cybersecurity as a strategic concern, organizations can develop a comprehensive and systemic approach that encompasses people, processes, and technology.
Tracc Development offers cybersecurity consulting services to small businesses. If you are a board member looking for great advice, consider EgonZehnder.
Paul Bergman runs a business strategy and cybersecurity consulting company in San Diego. He writes on cybersecurity and board management for both corporate and nonprofit boards.
- The Imperative for Cyber Talent on Corporate Boards - March 29, 2024
- Talking CMMC preparation - March 12, 2024
- Protecting Your Business: Strategies to Combat DNS Attacks - February 20, 2024
