The key fact to emerge in recent weeks is that most companies are losing the Cyber war and the most interesting aspect is “They do not know it”
When the White House starts discussing hacks like the recent Microsoft Exchange server hack then the following facts can be gleaned.
- This is now as much political as it is Cyber
- The scale make this a global or a top 10 event
- There is increasing concern that companies are not on top of the situation
- Alternative strategies are now being aired and discussed
A week after the White House announced it was concerned over the implications of the latest Microsoft Exchange breach over 70% of the affected exchange servers in question were still vulnerable. What does this tell us in who is winning this global struggle. The reasons are not clear but the evidence suggests that Information Security departments are not sufficiently empowered or motivated to make the necessary rapid timely changes. This may seem an an anathema to business leaders and external observers but on the basis that IT departments now have very rigorous change programmes with robust testing regimes this becomes much more explicable. This is also tied up into why are IT departments traditionally sluggish. Changes in IT often generate incidents and user dissatisfaction therefor operational IT’s best strategy is to minimise change. It takes business leadership 3-4 years to decide that IT is monolithic but a week to decide they are incompetent in light of a major incident or outage. With this in mind the optimum strategy for IT departments is to limit CHANGE!!!
