Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
BAE Systems Australia's cyber security head has warned against four mindsets preventing security specialists from effectively dealing with cyber threats.
According to the defence contractor's Tim Scully, an overemphasis on all-encompassing defensive measures or on compliance with standards or regulations could be counterproductive.
Scully, who was also the chief executive officer of BAE subsidiary Stratsec, chaired a work group on Cyber Threat and Fortress Mentality at the second national cyber warfare conference in Canberra this week.
He described the "fortress mindset" as the traditional approach to security, where specialists aimed to keep all threats outside of their networks.
Defensive measures in a "fortress" approach focused on systems and infrastructure rather than focusing on protecting the organisation's most valuable information.
That approach was as naïve as thinking that everything inside the network was secure, he said.
“If your network is connected to the Internet, and you have something of value to a threat actor, you are likely already compromised," he said.
Scully's description of the "compliance mindset" applied to security professionals who believed that compliance with standards or regulations necessarily meant that their information was safe.
“That is not the case. You can be compliant but not secure,” Scully said.
He argued that cyber security had to be incorporated as a routine agenda for executives and be subject to risk management at the most senior level.
As such, cyber security practitioners that engaged mainly with each other or their peer groups could be part of the security problem.
“They tend to confine their discourse at that technical level, engaging with others at the techie level,” Scully said.
Scully said that those in the "techie" mindset were rarely at ease communicating with anyone outside their specialist group.
An organisation could be compromised because they failed to share their impressions with senior management, he said.
On the flip side -- and partly as a consequence -- of the techie mindset was the executive mindset, in which security professionals over-simplified their concerns when communicating with business managers.
“What happens is that senior managers of organisations are denied an appreciation of the problem,” he said.
But those senior executives should understand better than anyone else the risks they had to deal with, Scully argued, adding that they also held the purse strings.
Fragmented and ineffective communication often resulted in techies complaining of not getting enough resources to do their jobs, he said.
“There can be a vicious cycle there,” Scully said.
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.