LinkedIn Qn: Assessing Needs for Cyber Cecurity

Today on LinkedIn I was asked a relevant question about Assessing Needs for cyber security:

"Begin by evaluating your current cybersecurity skill set against industry standards and the specific demands of your IS environment. Identify areas where you lag behind and need improvement. This might include knowledge of recent threats, mastery of new security software, or understanding advanced cyber defence strategies. Once you've pinpointed your skill gaps, you can create a targeted plan to address them, ensuring that your efforts are focused and effective." 

I found myself looking at all the answers professionals had posted and as one would expect they were all very relevant, but I thought they were lacking one crucial element, so I started posting my answer/comment, I had unfortunately run out of space so I've posted the full comment below:

All of the standard answers to the question of assessing cyber security needs:

 - Reviewing the risks against your current IS environment, checking for developments aired by industry leaders and training are all extremely relevant, very important and "common sense" at the end of the day, especially if you want to try and stay ahead of the curve.

However, I believe we all get caught up in the monster of a machine that security and technology create and forget the simple but huge risk that can be made by not communicating with the key stakeholders in the business being assessed.

Skills gaps are always going to exist in an ever-changing environment. 

Time is finite, and I think it's detrimental to focus on upskilling on something you don't know will be relevant over risks you don't know exist.

It's extremely important to keep your finger on the pulse of the business and have a relationship with all stakeholders about how the business is running and where it might be heading. People are generally the weakest security point when everything else is running smoothly. 

We all have days when we need that extra coffee or the boss is rushing you to do something last minute that they have forgotten they needed, shifting your focus and putting more pressure on your day...

Or alternatively, there's a process or system that's not working well "anymore" in the business,  it's creating pressure and someone's investigating a new system (which the security team aren't aware of), or even worse shadow IT is already in play.

Cyber Security is a high-pressure environment, partly from the pace of technology, adversaries and the extent of risk to a business but like technology, our thirst for wanting to know what the "latest and greatest" is adds more pressure and strain to what truly needs to be assessed.

I say if you're meeting the essential 8, monitor your assets with their associated risks and keep apprised of the Government and the bigger public alerts, your focus should be on the larger risks from the insider. These can only be understood and assessed through relationships and internal communication.

Keep your ears open and your finger on the pulse so you can close the risk gap before you don't know it doesn't exist...