The recent Optus data breach may well have been preventable, and the way Optus handled the breach was very average at best.
However, even if they did everything right, a data breach can still happen. ⚠️
The single largest Cyber Security risk in an organisation is its people 🤷. As long as there are people in organisations, there will always be a risk. Humans can make mistakes, be manipulated, tricked, and even engineered.
The reality is, Cyber Security is about risk mitigation, not elimination. There is no silver bullet.
It's a common belief that Cyber Security is an IT responsibility and unfortunately, many organisations put blind faith in their IT provider or department and put their head in the sand with the attitude that the IT guys are across it 👩💻.
Unfortunately, many IT providers just aren’t across Cyber Security. They may just not have the resources to upskill, they haven’t prioritised it, or their clients just don't have the budget or see the value💸.
We were once there too.
The fact that their clients expect them to be 100% across it doesn’t help, and ultimately the IT guys will cop the blame in the event of a Cyber incident.
For Cyber Security to be effective in any organisation, it must be driven from within. It starts from the top down and needs to be ingrained in the culture of an organisation with everyone ensuring it's a forethought, not an afterthought.
IT plays an important role in Cyber Security, but not the only role. We can help mitigate the risks to your organisation by setting up your technology in line with best security practices. There are also risk areas that are not our expertise, so it's important we stay in our swimming lane 🏊.
Last year a supply chain breach resulted in 800-1500 IT businesses worldwide and their clients' computers being the victims of a ransomware attack.
In that case, there might have been more that could have been done to prevent the infection, however, often the reason it isn't done is that the clients aren't willing to spend on necessary Cyber Security measures. This is the exact reason we have stopped selling most Cyber Security as a separate thing. It's just part of what we do.
I'm not blaming businesses either, as many just don't have the required information and understanding to make those decisions. Cyber Security is often complicated, and for many, it's simply overwhelming and they just don't know whom to turn to or where to start.
There is a lot we as IT providers, or the term I prefer, Technology Mentors, can do to navigate you through the complex and scary world of Cyber Security.
But we also can't force you to do it.
Until Cyber Security is legislated and becomes part of a Director's responsibility, which it should and will, things won't change quickly enough.
#cybersecurity #riskmanagement #business #beautifullysimpletech
