Satyamoorthy Kabilan’s Post

In the rush to adopt the latest and greatest #cyber #security tools, are we helping or hindering the work of our security professionals? In this article, it was noted that "Many SOC teams are managing too many tools and still struggle with an overwhelming number of alerts, leading to concerns about missing critical threats. This is driving a lack of confidence and trust in the current threat detection tools practitioners are using and resulting in practitioners seeking alternative solutions, such as extended detection and response (XDR) solutions. 71% of SOC practitioners worry they will miss a real attack buried in a flood of alerts and 51% believe they cannot keep pace with the increasing number of security threats. 47% do not trust their tools to work the way they need them to work, while 54% say the tools they work with actually increase the SOC workload instead of reducing it." My Gartner colleagues Chris Mixter and Peter Firstbrook also brought this issue up in the September #podcast episode of the #CISO Edge. Like many things in life, there is a balance that needs to be struck in terms of the tools deployed and the insights generated with what can be digested and acted upon without the user(s) getting overwhelmed. #infosec #resilience #CSAM #cybersecurity https://lnkd.in/gcpm-8GH

The mantra around #security #awareness has been a staple for #cybersecurity professionals for some time. But is awareness truly the endgame for #CISOs and #cyber security professionals? Some research my Gartner colleagues did a year or so ago found that 69% of the respondents to a survey had admitted that they had deliberately bypassed security controls in the last 12 months. Even scarier, 93% of those people who admitted doing the wrong thing, knew what they were doing and knew that their behaviour would increase risks to the business. But they did it anyway! Clearly awareness is not enough. My colleagues Chris Mixter and Richard Addiscott argue in a recent #CISO Edge #podcast episode that the focus really needs to shift to security behaviour and culture rather than just awareness. And a key to this behaviour and culture change is the need to deal with security friction. Many make the choice to take risky decisions from a cyber security perspective because it makes their job easier or they think that it has a business benefit. It's not that we should eliminate all forms of security friction and drop all of our controls - it means that we need to have a better conversation with the organization about what #risks are acceptable. Have a listen and see what you think. Does your organization focus heavily or even almost exclusively on security awareness? What role does security behaviour and culture play in your strategy? #infosec #resilience #CSAM https://lnkd.in/gAR7zdNw

The safe and secure functioning of Operational Technology (#OT) has been an area of increasing focus over the last decade or so. Malicious actors could use OT systems as a bridge into #IT systems. Additionally, because of their nature, compromise of OT systems, such as medical devices or power generation systems, could lead to life safety risks and/or other significant disruptions on a large scale. A number of key agencies, including the Australian Signals Directorate, Cybersecurity and Infrastructure Security Agency, National Security Agency, Communications Security Establishment Canada | Centre de la sécurité des télécommunications Canada, National Cyber Security Centre and others released Principles of Operational Technology Cyber Security recently to help organizations secure their OT environment. It is an interesting read and I am delighted to note that the people piece (Principle 6) is also emphasized here. #cyber #cybersecurity #infosec #resilience https://lnkd.in/gi9-Uu7f

October is #cyber #security awareness month so I thought that it would be worth sharing the recent Annual #Cybersecurity Attitudes and Behaviours Report from the National Cybersecurity Alliance and CybSafe. While technology is important, a key ingredient for building cyber #resilience is the behaviour of people, which sometimes gets forgotten in the rush to acquire the latest shiny security tool. A key element that stood out for me in this report is the continued risk that #AI use poses. According to the authors, 38% of those surveyed "admitted to sharing sensitive work information with AI without their employer’s knowledge." Also, it was interesting to note that "The belief that online safety is worth the effort decreased by 9% to 60%, and only 53% believe staying safe online is possible, a 5% decline." Worryingly, does this indicate that the complexities involved are pushing people to simply give up on cyber security and staying cyber safe? And when it comes to the basics like updates, "While 63% (-2% from last year) of participants said they know how to install the latest software and application updates across their devices, 17% said they don’t. Then there’s the 20% who said they knew how to, but tended not to install the updates, representing a 3% increase from 2023. The gap between awareness and action is widening, it seems." It strikes me that some of the key elements for the people side of the cyber security equation may not be trending in the right direction - and that is a cause for concern. What do you think? #infosec https://lnkd.in/g_jexKQ5

In the many debates around #hybridwork and #remotework, opinion abounds but data is scarce. So, I was really excited when Nick Bloom shared a link to a recent paper co-authored by Alessandra Fenizia at The George Washington University and Tom Kirchmaier at the The London School of Economics and Political Science (LSE) on working from home in the #publicsector. The paper found that the #productivity impact of working from home for public sector workers engaged in semi-routine tasks was an average positive effect of 13%! And this could more than double if managers were involved in allocating specific tasks that were suited to these workers. It is worth noting that, as I understand it, this was for workers who were spending 30% of their time in the office - so they were on a hybrid work pattern which was the status quo for them. When work from home was increased to 95% of their time, there did not seem to be any additional productivity gains. So, this reinforces the notion that you should get a productivity boost when carrying out focused work at home that does not require interactions with others, which meshes with some of the insights that my Gartner research colleagues have shared. And it also looks like hybrid work is potentially the optimal solution, in agreement with some of Nick Bloom's work that I have read. Very importantly, it also highlights the critical role of managers in ensuring that you get the highest productivity from tasks that are carried out remotely. What do you think? #FutureofWork #FoW #WFH #WorkfromHome https://lnkd.in/gXA9aej8