Defence contractor warns of false cyber security beliefs

BAE Systems Australia's cyber security head has warned against four mindsets preventing security specialists from effectively dealing with cyber threats.

According to the defence contractor's Tim Scully, an overemphasis on all-encompassing defensive measures or on compliance with standards or regulations could be counterproductive.

Scully, who was also the chief executive officer of BAE subsidiary Stratsec, chaired a work group on Cyber Threat and Fortress Mentality at the second national cyber warfare conference in Canberra this week.

Fortress mindset

He described the "fortress mindset" as the traditional approach to security, where specialists aimed to keep all threats outside of their networks.

Defensive measures in a "fortress" approach focused on systems and infrastructure rather than focusing on protecting the organisation's most valuable information.

That approach was as naïve as thinking that everything inside the network was secure, he said.

“If your network is connected to the Internet, and you have something of value to a threat actor, you are likely already compromised," he said.

Compliance mindset

Scully's description of the "compliance mindset" applied to security professionals who believed that compliance with standards or regulations necessarily meant that their information was safe.

“That is not the case. You can be compliant but not secure,” Scully said.

Techie mindset

He argued that cyber security had to be incorporated as a routine agenda for executives and be subject to risk management at the most senior level.

As such, cyber security practitioners that engaged mainly with each other or their peer groups could be part of the security problem.

“They tend to confine their discourse at that technical level, engaging with others at the techie level,” Scully said.

Scully said that those in the "techie" mindset were rarely at ease communicating with anyone outside their specialist group.

An organisation could be compromised because they failed to share their impressions with senior management, he said.

Executive mindset

On the flip side -- and partly as a consequence -- of the techie mindset was the executive mindset, in which security professionals over-simplified their concerns when communicating with business managers.

“What happens is that senior managers of organisations are denied an appreciation of the problem,” he said.

But those senior executives should understand better than anyone else the risks they had to deal with, Scully argued, adding that they also held the purse strings.

Fragmented and ineffective communication often resulted in techies complaining of not getting enough resources to do their jobs, he said.

“There can be a vicious cycle there,” Scully said.