
The enterprise org budgets being spent in relation to cyber security have, for a number of year, seen a steep increase however at the same time the volume of attacks and size of attacks have also seen a continuing and steep increase. From a return in investment point of view this doesn’t look good. In how many areas of a business or school would we be willing to accept increasing spends but worsening results?
Now this isnt such a big issue for schools and colleges as the available budget which might be applied to cyber security are very small indeed however viewed from a different perspective, this might mean it is all the more important to spend that which we have carefully and correctly.
Or maybe we need to start looking at the problem differently? If we accept that additional money and associated spends on technology tools and more staff won’t necessarily solve the problem then what can we or should we be doing?
Culture
I suspect this is key to how we need to approach cyber security. It needs to be “how we do things around here” rather than something which is seen as an IT issue or, where things have progressed a little further, an IT and SLT issue. Cyber security and appropriate cyber behaviours need to permeate a school, being the responsibility of everyone in the school community. Everyone needs to understand why it matters and what part they play in keeping users, data and systems safe. Now building such a culture isnt a quick process however I suspect it is something we need to start developing now, as part of a longer term journey to having more cyber resilient schools.
Measurement
Another area that is important is the need to have some form of measurement. In order to make sure our cyber efforts are effective we need to be able to measure this effectiveness. This might relate to awareness of phishing or a multitude of other measures we might create in trying to assess our cyber security. The key however is the need for some sort of measurement so we actually have some data as how we are doing, to help identify areas we need to focus on and to assess whether our efforts bring about the positive change we are hoping for. This measurement could be the data from a phishing awareness exercise, from help desk calls or even from a RAG (Red/Amber/Green) rating exercise. It needn’t be overly complex but it needs to provide some meaningful data in terms of where we are at the point the measurement is taken.
Accountability
The third area which I think is key, and which was shared at a TEISS InfoSec event I attended, is the need for accountability. We might have data as to where we are, or where a given department is or a school within a school group, but who is responsible and accountable for moving things forward? We need to ensure this is clearly identified and again it isnt simply an IT issue and instead should belong to the business, the school. It may therefore be that the HR manager is responsible for the HR dept, while the academic Head is responsible in terms of academic data, processes and staff. Whatever the accountability lines are, they need to be clear and understood.
Conclusion
On reflection, the above isnt a quick fix; culture takes a long time to develop and even establishing accountability and measures for assessing cyber readiness will take time. We need to ensure we are measuring the right things and that accountability is set at the correct hierarchical level, with this taking some time to get right. That said, the current approach, and complaint regarding lack of money/resources, doesn’t work as additional money/resources havent solved issues for those which have more of both money and resources currently. As such I think maybe we need focus on cyber culture in the same way we have previously focussed on safeguarding culture in schools. Maybe we all need to be focusing on cyber culture?