Roger Smith, CEO at R & I ICT Consulting Services Pty Ltd and Amazon #1 author on Cybercrime discusses why you need to prove your cybersecurity and digital security.
[Start of transcript]
Hi. Today I’d like to talk to you about how to prove your Cybersecurity is working. So you’ve put a lot of defense processes in place and now you need to find out how secure they have made your business. Now, in most cases the IT department will their own run tests or your managed service provider will run their own tests.
But those tests are based on what they know about how it should be protected. So they’re using best practices and they’re using the patching and making sure it’s got all the up-to-date information on them. But you can never be sure that that system is now secure unless you have someone test it. But the trouble is we’re testing it, you have to find a person who’s not going to put patches. Who is going to tell you exactly what you need to do. And also not rely on them making a report to you and then expecting you to pay for the fix if there is one.
So making sure that cybersecurity is secure and your organization is secure is really an ongoing process. But the outside world or the people who are attacking your business are using automated systems. They’re using automated scripts, they’re using automated systems to access social media sites and learning how and what and who you are. So you have to make sure that your cybersecurity is working. So how can you do that?
Well one of the best ways you can do it is you pay to have someone try and compromise your systems. But trying to compromise your systems, they’re using the same attack factors that the bad guys are using. They’re using the same processes that the bad guys are using. They’re not relying on, we know there’s a problem and we know how to get past it. But they are relying on how the hacker or the script kiddie or the hacktivist is going to try to access your system. So one of the big things about the IT world is we’re very arrogant. We all admit that across the board. What I say is how I do things. And when it comes to IT that’s what a lot of people believe.
But the problem is, with that sort of attitude, is it’s got no room for someone who knows something about the system that I don’t know about. So if I’ve got an external person coming in to test my cybersecurity then I know that they are going to use a different tactics, they are going to use different systems, they are going to use totally different objectives to what I expect. And that is what cybersecurity is all about. They maybe only getting in but you’ve got encrypted information of – all your databases are encrypted.
Then if they do get in they still read information, you get a report, but you’ll also know that that information hasn’t been able to be compromised because it’s encrypted. So when it comes to how you’re going to make sure that your systems are working, you need to prove your cybersecurity. And if you prove your cybersecurity your information and your business and the people who trust you to hold that information is going to be very very high.
Thank you very much.
[End of transcript]