What do you do if your IT Strategy clashes with your cybersecurity team's priorities?

In this case your IT strategy needs correcting. Any robust IT strategy must include alignment to a security-first mindset, period.

Cybersecurity should be integrated with all parts of the organization. IT and Cybersecurity strategies should be in lock step with business objectives. It’s important to right-size the Cybersecurity program for your enterprise and avoid projects that exist in a silo.

The primary objective of any organization is to sell their products or services successfully and earn profits that can support their business operations, risk management, and production efforts. While cybersecurity may not be the primary focus of business models, it is crucial to align cybersecurity measures with planned IT strategies, documented as Objectives and Key Results (OKRs), to achieve secure and resilient business outcomes. The broader goal of information security initiatives is not to hinder business and IT activities but to empower them. Therefore, it is important to ensure that IT/Business Objectives are not aligned with cybersecurity initiatives, but rather the other way around.

When IT strategy clashes with cybersecurity priorities, swift action is vital. Here's the plan: 1) Foster Communication: Encourage transparent dialogue between IT and cybersecurity teams. 2) Align Goals: Ensure harmony with organizational objectives. 3) Assess Risks: Prioritize and mitigate conflict areas with balanced strategies. 4) Establish Governance: Form steering committees/value stream teams for proactive decision making. 5) Educate Team: Promote collaboration and cybersecurity awareness. 6) Seek Compromise: Find shared solutions balancing innovation and security. Embracing collaboration ensures effective conflict resolution and overall security.

Despite the differences, there are likely common goals that both teams share, such as maintaining data integrity, protecting sensitive information, and ensuring system reliability. Identifying these shared objectives can help bridge the gap between the IT strategy and cybersecurity priorities.

- Address misalignment by understanding the root cause and fostering open communication. - Conduct a risk assessment considering threat landscape, vulnerabilities, impact, and likelihood. - Align decisions with business goals, involving stakeholders from both teams. - Prioritize risk mitigation strategies balancing IT strategy and cybersecurity needs. - Implement continuous monitoring and adaptation to ensure ongoing alignment and effectiveness.

Identify Conflicting Priorities: Use Wardley Maps to assess the risks and dependencies between IT strategy and cybersecurity priorities. Evaluate Impact: Analyze the potential impact of clashes between the two teams on overall business objectives, security posture, and operational efficiency. Mitigation Strategies: Develop mitigation strategies to address conflicts, such as prioritizing critical security needs within the IT strategy or adjusting cybersecurity measures to align better with broader IT goals.

It's important to assess risks on both sides: IT change may introduce new attack vectors that can be exploited by bad actors. Some technologies introduce more risk than others. Consider the risk/benefit ratios. New IT can also introduce new business advantages. To not adopt a new technology may result in a business risk, for example if competitors get some advantage from a new tech then this could lead to loss of revenue, or increase in relative cost. Cybersecurity is about protecting the business and assuring changes to IT are made without creating undue risk. There are many ways to address risk. Avoiding it is only one, there are also many ways to protect and mitigate against cyber risks; enabling benefit whilst controlling exposure.

Risk assessment is not a one-time activity: never has been. Beyond cyber there are many existential business risks. Power grid, Internet, events of nature, lack of sufficient talent to guarantee quality for consumer, employee, investor ... All belong in an integrated business strategy. Otherwise execution also at risk. CEO owns leadership responsibility for integration. It cannot be delegated in parcels.

Leading non-IT executives to some deeper understanding about information technology and its "guts and gears" might be necessary - somehow painful at the first moment, but definitely worthwhile.

IT Strategy is about enabling the business to attain its goals in a sustainable way, leveraging technology to deliver more value and efficiencies, improve competitive advantage, grow market share to increase profit or value delivered on an ongoing basis. Strategy is about the long view. Think of the game of chess; often it's necessary to make preparatory, enabling moves to be able to make progress. Pushing a pawn forward might not have that much impact but its impossible to get your queen out unless you do. It's the same with IT. IT Strategy is not just about the big moves, its about coordinating change at a rate the organisation can safely absorb to transform the underpinnings of how value is delivered by the business.

Cybersecurity professionals should bear in mind that providing an accurate risk-impact equation requires an extra dose of technical transparency and honesty - not being too dramatic, as well as not being excessively careless.

It is not only about smooth implementation of IT initiatives. It is about leadership to develop foundation roadmaps for execution of business strategy - which includes IT, cyber, operations + all other assets of consequence. And thinking forward, taking action to allow for success of all initiatives needed to deliver on promises made to consumer, employee, investor. CIO owns IT, cyber and digital. CEO owns business high-table of which CIO is ex-officio member.

Mitigar os riscos s?o as prioridades, reavalie sempre quaisquer que sejam os pontos, verifique com cada envolvido, exponha detalhe e chegue a um senso em comum.

I disagree with the premise of this question. IT and CyberSecurity should never be separated organizationally or educationally to need the type of communication proposed. All areas of digital expertise need to interact seamlessly on every project based on a common foundation of shared training and experience. Singular digital leadership, accountability, and cross-functional teams as the default workgroup can accomplish this.

Having a dedicated timeline is important to address the vulnerabilities. In my experience, fixing a weekend eg. 2nd weekend or the 4th weekend, of every month can be dedicated to fix the vulnerabilities. This helps communicate the timelines with the Cyber security team and can avoid the conflict as much as possible. This way the key stakeholders are also well informed about say downtime of a system and can plan or prioritise their work accordingly. Here communication is the key.

Clarify Objectives: Clearly articulate the goals and objectives of both the IT strategy and cybersecurity priorities to ensure mutual understanding. Facilitate Dialogue: Organize meetings or workshops where stakeholders from both teams can discuss concerns, share perspectives, and brainstorm solutions. Align on Impact: Use Wardley Maps to visualize the impact of conflicting priorities and collaboratively identify areas where adjustments can be made to mitigate clashes and achieve alignment.

Communication and alignment have to come first to align on goals and constraints. Then define time timelines jointly and review regularly all topics with SME.

Informing staff about key business decisions and rationale for those decisions helps them understand the principles and priorities of the business. This is leadership. People throughout the business are empowered to make decisions of their own at their own level. They will, in part, make these based on the cues they get from leadership and the lessons they learn from that. If they are informed about decisions without being given the context and rationale, they may make incorrect assumptions about business priorities and security posture, appetite for risk, strategy, etc. Being clear about what decisions have been made, what trade-offs those involved and why along with future plans to redress balance helps shape how others make decisions.

"The whole is greater than the sum of the parts" - Aristotle Another chess analogy: You will lose if you just move a pawn and then run around the board with your queen whilst your opponent carefully develops all their pieces and formulates plans to use them in combination to create overwhelming advantages. Businesses need to consider Innovation, Competitors, Security, Finances, Regulation, Law, ... Hence businesses have many teams of people with different knowledge, skills, experiences, and disciplines. Hence, IT Strategy is not just about IT & Cybersecurity is not just about protecting against attack vectors. They are both about how you do that within the context of the overall Business Strategy. Collaborate, collaborate, collaborate!

Step one should be to Collaborate. IT Strategy of any organization / business unit will not succeed if it works in a vacuum. Success of any action comes from collaboration. Habit 4 of 7 habits, Think Win-Win and Collaborate. It will help to gain support from other business units and teams in the organization to achieve your / your teams goals and strategies.

Collaboration in below ways can help: 1. Bring in Open communication 2. Align on Shared Goals 3. Risk Management & Prioritization 4. Compromise & Solutions to ensure we achieve the goal as well not to miss out of security which is key as well. 5. Collaboration & Teamwork- bringing in joint ownership of results will ensure we collaborate for greater good.

I’m a strong believer in collaboration since we work for a common company with common goals and objectives. Getting the teams to explain and understand each others challenges, brain storm, get external help and try and find ways to make both work is crucial for the success of the operations as both are equally important and striking a fine balance including assessing the risk and having a plan to mitigate is what works best in my experience

Had the role of negotiator between my application development teams and network security. Our network security manager had to deal with access denial attacks, corruption of servers, because we were a tobacco company. New business requirements with wholesale trade, consumers, ad agencies, law firms required data access across the internet requiring a robust firewall requirements

Implementation of CVE i.e., Common Vulnerabilities and Exposure scan is critical in any infrastructure. This ensures the infrastructure is always being scanned for the vulnerabilities and their patch is being applied on time. Keeping the infrastructure free from potential threat is not only a Cyber security team's job. Every application team should bear this responsibility and should coordinate with the Cyber security team as and when needed. Based on which both the teams can work together and address the potential threats.

Well, in that scenario, it's crucial to find a balance that aligns both IT strategy and the cybersecurity priorities. I'd initiate open dialog between the two teams and understand the root cause of the clash.Perhaps there's a misunderstanding or a lack of communication about the overarching goals. Finding common ground and adjusting strategies where necessary can help ensure that both IT and Cybersecurity are working towards the same objectives while addressing their respective priorities. Collaboration and compromise are key to overcoming such challenges effectively.

Regularly reviewing the IT strategy and cybersecurity priorities is a fundamental practice for organizations to ensure they remain effective, adaptive, and resilient in the face of evolving technological landscapes and security threats. This process involves systematically assessing, updating, and aligning IT strategies and cybersecurity measures with changing business goals, emerging technologies, and the evolving threat landscape.

To reconcile IT strategy with cybersecurity priorities: Communicate: Open dialogue to understand each side's needs. Find Common Ground: Identify shared objectives. Compromise: Adjust both strategies to accommodate critical concerns. Unified Approach: Integrate cybersecurity into IT planning. Regularly Review: Adapt strategies as needed. Prioritize collaboration and flexibility to align both areas effectively.

Adopting industry best practices and adhering to recognized standards can help bridge gaps between IT and cybersecurity objectives. These frameworks provide a common language and a set of benchmarks that both teams can align with. Sometimes, an external perspective can be invaluable in resolving conflicts or providing insights that internal teams might overlook. Consulting with industry experts or hiring a third party to assess the alignment between IT and cybersecurity strategies can offer new solutions and validate the chosen path.

I'm just wondering how it can be that an IT strategy, which is a real strategy, can even stand in the way of security requirements. The strategy formulates the goal and the measures to get there. Cybersecurity defines the rules that must be adhered to when implementing the measures. Security can and will never prevent strategic goals, but could a conflict in the way they are implemented. So when you have discussions like this, you know that you don't have a proper strategy, but that you are already in the process of implementing it.

Something is profoundly problematic if your IT Strategy is at odds with your cybersecurity team priorities. As the protection of assets is likely at the foundation level of your IT Strategic Pillars, its not possible that you have strategic objective differences with the cybersecurity team holistically. Its far more likely that you disagree on which shirt term priorities (IT or Security or Combination) best positively impact the risk the organization is willing to take, yet move the needle on the business goals short and mid term. Your best bet is get back to basics and combine the priorities together and assess/rate/grade them as a group, the classic (risk/value/effort) dimensions.

It's like you want to run a show without adequate lights. What is required is to explore opportunities for compromise where both the IT strategy and cybersecurity priorities can be accommodated to some extent. This might involve adjusting timelines, implementing additional security measures, or finding alternative solutions that strike a balance between innovation and risk mitigation.