News & Thoughts from the Axenic Team
We think that the new version of NIST’s Cyber Security Framework is a significant improvement. There’s one big change, but it is the lots of little changes that add up to a massive overall improvement. New Zealand organisations will still need to do some work to plug some of its idiosyncratic gaps, however.
As a non-Muslim I knew nothing about Ramadan – I’d heard that it involved fasting but was ignorant of any details or of its significance. Realising that it was an important part of the lives of some of my colleagues, I decided to ask them about it. What surprised me – knowing little about Ramadan – was the joy that they clearly felt.
Take a moment to imagine a world with gender equality. No bias, no stereotypes, no discrimination. This year’s International Women’s Day focuses on encouraging people to overcome gender biases towards women. We are trying to eliminate gender bias by showing our support and encouraging diversity. We’re very fortunate that our team here at Axenic is made up of a number of passionate and experienced women who are all outstanding professionals in their field. In support and recognition of International Women’s Day this year, we would like to take the opportunity to introduce you to them.
Primarily the story about the Russian invasion of the Ukraine is one of great human tragedy. Nothing I write here is supposed to take away from the fact that the main story is about the suffering of the Ukrainian people.
Even at the other end of the world here in Aotearoa New Zealand, however, there will be impacts. Though they may just be echoes of the fury in Europe. It’s no secret that cyber attacks are part of Russian military strategy, nor that New Zealand organisations have been the victims of Russian cybercriminals. So what effects – if any – will the war in the Ukraine have on cyber security here?
Recently I’d been helping a customer negotiate their cyber security insurance – which turned out to be trickier than I expected. This got me thinking about the role that insurance played in cyber security. Then – coincidentally – I was reading a book on security (Paul Martin’s great “The Rules of Security”) and came across this sentence: “Insurance is sometimes described as a means of transferring risk, but it is really more of a mechanism for softening the financial impact of a loss.” (p 73). It got me wondering – at Axenic have we been thinking about insurance all wrong?
All the experts agree – cyber security should be an organisation-wide concern. And yet, in my experience too many organisations, and too many people in those organisations think that cyber security is solely the concern of (a) the security team, or (b) the IT/digital team. In case you need convincing my favourite response is that if there is a cyber-attack (or incident) then it is not the IT team’s job that is at risk, but part of the organisation (if the HR system is compromised it is the HR team who won’t be able to work, not the IT or security teams). Who knows what the impact is of an attack? It’s not IT, that’s for sure. And who is best placed to balance off the needs of the organisation with the cyber risks? It’s not security: if you left it up to me, I’d turn everything off! That’s the only way to be sure (and I get no benefit from it being on, so…)