Call us now:
There’s a lot of merit in what Dimitri van Zantvliet says in his post.
Cybersecurity risk management is a role play. It’s a swan presenting a beautiful picture of serenity above water, whilst its legs are kicking hard and pushing against the tide. A tide that of market forces, governance, ignorance, threats and a tsunami of digital.
The patient – the entire cybersecurity model – is on a string of life-sustaining devices: AI-enabled governance, next-gen firewalls, zero-trust frameworks, XDR monitoring that beeps like an IV. And yet the symptoms are worsening: more data breaches, more blind spots, copilot and lovable, more fatigue, more threat. Another cyber law!
If cybersecurity were indeed a medical patient, what process would a doctor follow to treat them? Firstly there’s a pretty good chance that they would evaluate the patients symptoms; run tests; evaluate cause and effect; they’d probably go check out a big medical book of knowledge built over many years. All before they prescribe treatment.
In cybersecurity we usually jump in with solutions to fix problems that we do not understand. We listen to ‘snake oil’ salesman that prescribe cures for problems that don’t exist or we have little knowledge of. We forget to plan for a potential terminal incident (Marks and Spencer). There’s no big book of knowledge to evaluate the symptoms, and there’s little in the way of cause and effect to test out responses to risk mitigation.
It’s time for a rethink. AI is coming over the digital hill and one wonders how we treat the patient as quickly as AI can react to the medication, without a rethink. Especially when one considers the level of pre-positioning that has taken place by nation states over recent years.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation #artificalintelligence
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7331990597433499648