Communications of the ACM
Changing the Way Businesses Defend Against Cyber Attacks
Credit: NPR
Hackers have attacked news organizations, social media sites, major corporations, and government agencies, accessing private documents and personal information. Still most organizations do not prioritize cybersecurity as a strategic competency. A group of Iowa State University researchers say it is time for that philosophy to change. Corporations must develop a proactive strategy so they are not forced to react when there is a threat or security breach.
The cost to a corporation or the customer if hackers gain access to secure information is one factor to consider. With the growing demand for digitally shared data and information, security can no longer be viewed as just a necessary cost of business, says Anthony Townsend, an associate professor of supply chain and information systems in ISU's College of Business.
"If you have an active and aggressive security team in the organization, you don't have to get hacked," Townsend says. "It's like leaving your door unlocked. If a burglar comes to your house and can just walk through the door, well, that's easy for him. But if he has to jimmy the lock and there's good security, he'll go someplace else."
Companies are certainly not just sitting idly by, but too often those making the decisions about security lack information technology expertise, says Samuel DeMarie, an associate professor of management. If an organization waits to test the effectiveness of its cybersecurity until there is a problem, it's too late.
"On a more global perspective, there needs to be more IT expertise at the very top of corporations," DeMarie says. "The way organizations use information technology is critical to the success of a company. If you're not doing it well, it doesn't matter how great your product or service is, that can be enough to shut down a business."
Increasing Risks
Connecting instantaneously with other firms is a necessity for businesses to share information quickly and efficiently. Unfortunately, it increases the security risk, says Brian Mennecke, an associate professor of supply chain and information systems. He expects businesses, especially small-to-midsize businesses, to outsource security as the threats to information systems become more complex.
"I think increasingly that's what we're going to see with organizations moving more of these sensitive operations that are vulnerable to attack, to platforms where they can trust a vendor to provide a higher level of security than they would be able to provide themselves," Mennecke says.
On an individual level, Mennecke compares outsourcing security to the decision to purchase a bank lock box. It is a way to protect important documents that you fear cannot be kept safe at home.
"There's a cost involved, but there's a greater good to achieve by making sure important documents and resources are maintained as secure," Mennecke says.
Of course, there is also an inherent risk in outsourcing such a critical function as security. There is no 100 percent guarantee and it is difficult to repair the damage if a third party violates an agreement. The case of Edward Snowden, a former National Security Agency contractor who leaked confidential documents to a journalist, is just one example of what can happen when that trust is broken.
Shifting the Culture
Making cybersecurity a priority within a firm's operational plans is more than an investment; it's a shift in the organizational culture. DeMarie says a company must weigh that investment with the potential costs and loss of business if hackers successfully shut down its information system.
"A cyber attack could be devastating to some companies," DeMarie says. "Millions of dollars could be lost if they were shut down. I think a lot of companies just feel like they've got it covered. They hope their IT guys know what they're doing."
But DeMarie, Townsend, and Mennecke see a strong cybersecurity system as a competitive edge to attract new clients and customers.
"A proactive and well-managed security function in the organization means your customer credit card numbers are safe. You're not in the newspaper because you got hacked recently. It actually appears to convey a specific advantage in terms of customer retention and satisfaction with the firm knowing that you have decent security. It's not an afterthought," Townsend says.
Security will increasingly become a greater priority for customers and clients as more business functions are handled online and digitally. Townsend says the organization with the stronger security presence will have the advantage. The three researchers will present their paper, "Strategic Information Systems Security: Definition and Theoretical Model," in August at the 19th Americas Conference on Information Systems in Chicago.
No entries found