Security Should Not Become a "Business Disabler"

Welcome. My name is Martin Kok. I'm principal Analyst at Kona code today. I will talk about very hot and challenging topic in these days, which is the balance between enabling people to work specifically, enabling people to work from home and cybersecurity. And apparently there's a risk that cybersecurity ends up again. And that role, which is very, I think, common for cybersecurity in some ways over the past, which is the role of theor naysayer. So we can't do that because it will not be secure enough. We can't use zoom because there have been security issues.

We can't let people work with their own device from home because it might not be secure enough. We can't use outlook web access, even while we technically could do it because there might be some security risks and we haven't deployed multifactor authentication yet, et cetera. I hear these arguments quite frequently, to be honest. And on the other hand there is this, how can I enable people to work? And one of the, probably maybe the most important thing is enabling people to do their work in these days. So if they still can work, do everything that they can do.

And that is where I believe it's very important to find a good balance between security and the business enablement and to go for more pragmatic solutions and last, not least to trust the good human sense. Most of your workers will have. I recently published and it's in the blog and five minutes security awareness training. There are a few things you can easily communicate to your colleagues, to your peers, to your employees about how to do, how to work securely. And this is a very important thing, and people will do that very they're very vast.

Majority of people will work with a good human sense. So think about what can you do to educate your people, to be aware of certain risks and to use certain tools secure. So if it's about, let's take a tool such as zoom or other tools in that space. Why don't you give them trusted two pager with a few screenshots and saying, okay, use debt, setting debt, setting, debt setting, then it's secure enough. And by the way, that never will be 100% security. There is no such thing as 100% security, we need to balance it. So look for pragmatic solutions instead of stopping people working.

And there are a lot of pragmatic solutions and at the end, it's better than bypassing solutions because there's too much security. And I have a strong belief. We can do a lot of things, even when we are not well prepared by using web access to certain tools by using communication tools, by explaining how to configure the system at a certain levels of security and to look at what can be a challenge to security. So be aware of fishing and all the other stuff there's a lot we can do. And the same security definitely master avoid us today.

These days becoming the notorious naysayer and inhibiting businesses from doing their business, being the showstopper, our business continuity. That's not what we can afford these days. We need to be more pragmatic. And so it's really a call from my end to become more pragmatic in the way we do security. We still can achieve a very good level of security and many of the tools we are using today, such as all these collaboration tools, most of them have a very good level of security we can use out of the box, plus a little bit of simple extra actions and we are relatively good.

And the next thing then will be prepare for being easier and even more secure, able to use such tools. But to be honest, if even organizations in critical industries can make use of tools such as Microsoft teams and Microsoft 365 office 365, then apparently these tools can be used in a secure enough manner if it's even for these industries.

So the, I would say the point where you really could say no as a security person, or we can't do that. This bar is raised very high these days and don't go over the top, be pragmatic and enable your business. Continue to that is what I strongly recommend. Thank you.