Defence from an attacker’s view: Rethinking traditional approaches to cyber security

In many organisations, cyber security is considered to be an information technology (IT) problem. However, the traditional relationship between IT operations and cyber security teams, where one is focused entirely on carrying out business-as-usual activities and maintenance while the other attempts to prevent cyberattacks, is outdated and leads to an increased cyber risk for organisations. These long-held views and failure to fully integrate current cyber security methodology and principles into IT-related business processes not only increases the likelihood of a successful cyberattack but exacerbates the resulting damage. It is not possible for organisations to prevent every attempted cyberattack; instead, organisations should expect and plan for breaches. This paper explains how implementing an assumed breach paradigm and combining the knowledge of IT operations and cyber security teams to form a combined CyberOps function can help close gaps in defence and incident response preparedness.