Security Needs to Be Job 0
Security in an Organisation - Job 0
I was recently fortunate enough to attend the JISC Cyber Security Conference 2024 in a rather cloudy and flooded Wales. Despite the weather, the talks went ahead – and what talks they were! The speakers were primarily from the higher education and research sectors, alongside security vendors from across the globe. CrowdStrike, Sophos, Arctic Wolf – you name it, they were there.
One thing stuck out to me more than anything else, one sentence that’s been running through my mind weeks after the event, compelling me to write this post and try to make sense of it. The sentence?
Security is Job 0.
I know, hardly revolutionary on its own. If you work in IT or Cyber Security, you're probably thinking, "Yeah, no sh*t, Sherlock!" But bear with me.
We’re all painfully familiar with the scenario: you need to patch an endpoint or server running a legacy OS or application, only to be told, "NOPE! That service is far too important to be touched. Leave it be!" And yet, in the same breath, you're reminded to adhere to Cyber Essentials or ISO 27001 standards. These two things are diametrically opposed.
During one of the talks at JISC 2024, the Head of IT at a top university shared their experience with a cyber incident and the changes that followed. The crux of it? Security became Job 0. Before the business could make money, before systems could be upgraded, before Deborah from Accounting could install that fancy software she loves (and no one else uses), realistic security processes had to come first.
When the responsibility – and consequences – shifted to the user instead of IT, those same users began chasing IT, asking for their servers to be patched and seeking advice on how to help. Suddenly, the dramatic claims that "updating that server will bring the organisation screeching to a halt!" vanished. No alarm bells rang. Nobody complained. It was all smoke and mirrors – a human issue, not a technical one. If an action is perceived to create more work for someone – or even if they simply believe it might – they will oppose it. That’s exactly what had been happening for years at the speaker's university. Layers upon layers of bureaucracy had been conjured up out of thin air, forming a gauntlet of hurdles for IT to overcome before being allowed to patch a system.
"You’ll need to speak to so-and-so, who reports to so-and-so – oh, and so-and-so will be extremely angry if this impacts X, Y, and Z… No, no, it cannot be done."
And yet, once the responsibility shifted, all of it – every excuse, every roadblock – simply faded away.
This isn’t about power or IT being the arbiter of all things; it’s about culture. To be secure, your organisation needs a culture that accepts security isn’t the job of just one team or another – it’s everyone’s responsibility. Everyone has a role to play in this delicate Jenga tower of security, where one careless move could bring the whole thing crashing down.
However, the culture needs to go much deeper than simply getting everyone to care. As the speaker continued, he began to talk about what happened after the incident, once all the systems were up and running again and everything had been recovered. That was when the dreaded question came down from the directorate:
So. Who’s fault is it?
This is where a culture shift is still desperately needed. The speaker explained that if a burglary occurred, a window was smashed, or a pipe burst, nobody would waste time trying to pin the blame on someone, demanding to know who caused this. Yet when it comes to IT, that’s still the default attitude.
Directors and management needed to understand that, in most cases, their research institute, university, or school had what? Three to five people managing the cyber security? And who are they up against? The answer is nation-state-backed organised crime, or, in some cases, nation-states themselves.
IT – the same team that had implemented such an effective backup strategy that they restored the entire infrastructure from backup in less than six hours, avoiding the need to pay any ransom. IT – the team that discovered the attack and closed the attackers’ entry point mere minutes after it began. IT – the team that followed every best practice in the book, but who, because of the existence of zero-days, still had to remain constantly vigilant. And yet, after all of this, they were asked the question: Who’s to blame?
A significant conversation had to take place to help the directors grasp the sheer scale of the resources and capabilities their attackers had versus the three-person team defending against them. The message was delivered: for large educational and research organisations (and quite honestly, small, medium and large organisations throughout the world), it’s not a matter of if you’ll experience a breach, but when. With the help of third-party experts, this conversation helped the directors understand the enormity of the challenge and facilitated a shift in culture. It was a vital step towards aligning expectations with reality and fostering a more supportive and proactive approach to cyber security.
The speaker elaborated further, explaining how their security incident had resulted in the full backing of the directors – and that this was pivotal. The mandate for secure infrastructure must come from the top down. Without support from all levels of management and decision-makers, someone, somewhere, will eventually topple the Jenga tower.
Reflecting on my own experience at university, I remembered my networking and cyber security lecturer once warned me about the reality of the industry. He said:
In industry, no matter the business, the budget for cyber security will always be tight. But after a cyber incident, you’ll be given a blank cheque. Never let a good crisis go to waste.
At the time, I thought his words were a bit tongue-in-cheek. Thankfully, I’ve never experienced a cyber incident myself to test this theory. Sadly, as the JISC speakers continued, it became clear that his words rang true for many of them.
Throughout the three-day event, one message became abundantly clear: culture is the key to success. Every single organisation, no matter where in the UK they came from – whether a school, university, or research institution – faced the same challenge. They all had users who would throw their toys out of the pram if they were inconvenienced or didn’t get their way. Historically, because the work those users did was deemed so important, or because they held senior positions, the organisation would bend over backwards to appease them. This undermined IT and Security, creating vulnerabilities that eventually led to breaches.
So, this is my plea to the UK – and to the world: Make security Job 0. Nothing else should happen until it can happen securely. If the work you’re doing is truly important, it deserves to be done securely.
.jpg "Solar Panels")
