How can you innovate and stay secure in your IT environment?

Honestly; get help from the outside. You might be very blind on what is going on inside your systems and processes. But get hands-on help, not just high-level slides consulting.

The place to start is with an independent assessment; if you are reviewing your cybersecurity landscape, you will naturally be more lenient and overlook the small mistakes you are making. Where you should be starting is with an independent 3rd party telling you where the gaps are; now, this can start with a simple paper exercise or with a more in-depth vulnerability assessment. But it must be driven from outside your business and against a framework or standard your business wants to achieve.

You want to have security requirements for your innovation projects, just like you would other areas of your business. When you procure a new system you have security requirements, when you build a new application you have security requirements. Take this approach to your innovation, in fact when innovating you should look for risks and vulnerabilities in the work you are doing. This is not only to secure the solution, but to be able to market that you are security minded when it comes to innovation.

Defining goals and priorities are important because having a clear understanding of your current state allows you to set informed goals and priorities for innovation and security. It helps you identify the specific problems to address, opportunities to seize, and outcomes to achieve. By aligning these goals with your business strategy and objectives, you ensure that security efforts support broader organizational goals.

Your priorities need to go beyond just being secure and ticking boxes. You also need to look at the broader business goals and align your cybersecurity to the goals of the rest of the business. It is pointless driving for change in the wider business see that as counterintuitive to the broader business direction. Think big when doing this as well. The goals need to seem like massive changes with smaller sub-tasks that lay the path for the bigger improvements.

Just because a cyber partner has a flash website or has the best marketing doesn't make it the right fit for your business. You need to review the market actively, what products fit your business needs and align with your vision and more comprehensive product stack. You will see diminished returns if you select technologies based on the brand rather than the product. The same goes for partners. It would help if you looked for partners with a long history in the space, not someone who has jumped on the cybersecurity band wagon to increase profit share.

Indeed, continuous improvement is key to innovation and security. By identifying gaps and challenges, you can refine and optimize your IT environment using lessons learned and best practices, ensuring that your systems and processes remain effective and secure.

We need to understand that balancing innovation and security is a fundamental challenge in IT. While innovation is essential for progress, it can introduce vulnerabilities so we need to strike the right balance.