At a time when cyber-attacks are multiplying and having an increasingly serious impact, the Cybersecurity Committee wanted to give a precise scope to the notion of cybersecurity.
This refers to all the activities carried out by an entity to anticipate and reduce risks in the event of a digital attack, and to ensure the entity’s resilience in response to the attack.
Cybersecurity activities can be either technical, organizational, human or legal in nature.
The Committee will evolve this definition as threats and technologies evolve. In the course of its discussions with ANSSI and the organization of mornings dedicated to cybersecurity (the next will take place on October 22, 2015), it will have the opportunity to clarify this notion.
Syntec Numérique’s cybersecurity committee proposed a broad definition of cybersecurity covering the anticipation and reduction of risks associated with digital attacks and the ability to maintain or restore activities afterwards. The approach covers technical, organisational, human and legal dimensions.
This matters because buying a security product does not by itself make an organisation resilient. Effective security depends on risk ownership, access control, staff awareness, tested backups, supplier oversight and the ability to respond when an incident actually occurs.
A realistic cybersecurity programme begins with identifying the assets and services whose loss would create the greatest disruption. The next steps are to assign responsibility, review access rights, keep systems updated and establish reliable recovery procedures. Suppliers and cloud services belong within the same risk picture. Testing an incident response plan is often more informative than assuming a policy document will work in practice. Cybersecurity should be understood as continuous management rather than a one-time purchase of technology.
Cybersecurity becomes clearer when framed around three goals: lowering the likelihood of attack, limiting damage and restoring services. That framing avoids reducing a complex organisational discipline to individual software tools.
