The stereotypical corporate information technology department is seen as overworked and underappreciated; until some part of the business’s technology environment is inoperable. In this event the IT staff is then cursed for being unable to fix the problem immediately. IT staffers often feed this stereotype by professing an ability to solve all problems, including cybersecurity issues that threaten to shut networks down with ransomware or that can expose a business’s data to hackers. Cybersecurity has become such a specialized and complex environment, however, that a business will be better served either with an internal cybersecurity staff or by outsourcing its cybersecurity needs to specialists that devote their full time to monitor the ever-changing cybersecurity threats that businesses face.
The following arguments will dispel doubts about this recommendation:
Cybersecurity involves more than just technology.
IT specialists create and implement technology solutions that help a business grow. Cybersecurity specialists evaluate and understand the value of a business’s data assets, the regulatory compliance issues faced by businesses in different industries, and the threat levels that data in different industries can raise. For example, health care businesses are exposed to HIPAA violations if their patient data is stolen, whereas companies in the financial industry are more exposed to Graham-Leach Bliley or Sarbannes-Oxley violations.
IT focuses on optimizing the technology operations of a business.
A good information technology department will devote all its time to creating the smoothest network operations that keep the business moving forward and making money. Cybersecurity personnel train employees in best practices, develop response plans to potential threats, and monitor external attempts to derail the network. Adding cybersecurity responsibilities to an IT team’s workload only impairs that team’s ability to maintain a robust network while shortchanging the amount of time that is required to maintain proper cybersecurity defenses.
Cybersecurity specialists are in short supply.
Cybersecurity is a separate and distinct field from information technology. Industry watchers have observed that there is a severe shortage of specialists who can manage a business’s cybersecurity operations and responses. A business which assumes that its IT staff has the training and expertise to take on cybersecurity responsibilities inevitably overestimates the IT staff’s expertise and underestimates the severity of the threats that its network faces.
Employees adopt tools that are not installed or supported by IT.
An IT department will be charged with implementing the software and mobile applications that a business needs to conduct its operations. Notwithstanding policies and warnings to the contrary, employees will install unapproved software and apps on their devices, and those apps can expose a business network to multiple different cybersecurity problems. A dedicated cybersecurity team will be better able to monitor and control employee-installed software applications that have not been authorized by IT.
Network intrusions are all but inevitable.
An IT team might respond to elevated cybersecurity threat levels by adding more and more technology protections while ignoring a broader approach that involves risk mitigation across the entire business. Dedicated cybersecurity specialists know that Denying the inevitability of a data breach is a prescription for disaster, and in recognizing the likelihood of an attack, those specialists will adopt strategies that involve recovering from an attack and making resources available to rebuild internal systems and compensating third parties that experience losses as a result of the attack.
Cyber insurance is one of the most direct and effective strategies for that purpose. Cyber insurance carriers will work with a cybersecurity team to identify and assess data that is most vulnerable to a cyberattack, and to implement strategies to mitigate those risks and to insure against losses when those strategies fall prey to a hacking attack. Even a small or midsize business can suffer tens or hundreds of thousands of dollars of losses and third party liabilities from a successful cyberattack. Cyber insurance is frequently the difference between recovering from the attack and going out of business altogether.