Telstra, Australia’s incumbent telco, held their Cyber Security Summit in Sydney today looking at the issues facing organisations in protecting their networks and data.
One of the recurring themes speakers raised were the ‘five knows’ that Telstra’s security people believe are the core of business security.
Those ‘knows’ sound simple but in truth in they are hard to carry out in even a small, simple network;
- Know the value of your data
- Know who has access
- Know where the data is
- Know who is protecting the data
- Know how well that data is being protected
With these five rules we’re moving into Donald Rumsfeld territory of ‘known unknowns’. In most organisations the honest answer to these questions is “we don’t fully know”, some data that’s seen as irrelevant by management could be a goldmine for a competitor or malicious actor while a relatively junior staffer could be saving critical documents on an external drive or consumer cloud service with a weak password.
Managing those knowns, or unknowns, is a tough task and one that needs to be tempered by realism.
In truth no system administrator has full knowledge of their network, for organisations real security comes from having strong leadership, robust processes and delivering the products and services demanded by the public.
Technology will help deliver those products and services while helping strong leaders implement robust process but ultimately a secure organisation needs good management, not better tech.
From the cyber security point of view, Telstra’s forum had many useful thoughts and we’ll look at more aspects regarding security that came up in the sessions later in the week.