Blog: IT-sikkerhed på dagsordenen
How to understand the threat against Danish government and private companies
[21. januar 2016] A report from ’Trusselsvurderingsenheden ved Center for Cybersikkerhed’ in Denmark shows that the threat level against Denmark’s authorities and private companies are very high. According to Thomas Lund-Sørensen, manager for Center for Cybersikkerhed, this means that hacks are occurring. This comes as no surprise for anyone working in this field but the interesting questions are rather:
- Why is the threat level high?
- Why are hacks happening?
The answer is both simple and not. First of all cyber security has not been seen as a real problem. Hacking has been something that only 15-year old kids with pimples have been doing for fun and to create a bit of extra work but nothing more. The shift to organised crime and military operations has been silent but that is where we are today. Organised cybercrime costs the world about €400 Billion yearly and still many companies and authorities do not take the threat seriously and still thinks that a simple firewall and antivirus is enough.
Companies that decides to take the threat serious and are taking steps to prevent it finds them self bogged down with investigations, time consuming configurations and slow processes. It´s not uncommon for a patch process to be allowed to take 30 days giving the hackers 29 days and 20 h to try to hack you with a zero day.
Another shift that´s happened is the mobile and digital. We are now doing a lot of work outside the office and we are moving process after process fully online exposing the organisation´s systems for anyone to hack. The secure office network is dead and security mechanisms needs to move to the device instead and information needs to be protected where ever it resides. New systems needs to be security tested as if they are exposed on the internet because that’s where they end up anyway.
It may sound as a large struggle but in fact it´s not. There are several patterns that describes how you should create a secure company but the problem is often that outdated policies and used to implement outdated technology instead of using modern policies that mandates security mechanisms that in turn are implemented with technology and processes.
It is possible to be agile in a secure way but to be able to do that you need to stop protecting against everything and instead be quick to manage incidents and stop the hacker dead in its tracks. Go agile securely.