Cybersecurity Fosters Competitive Advantage

Tens of billions of dollars each year are spent on cybersecurity, yet cybercriminals continue to succeed. There seems to be a never-ending stream of cybersecurity bad news. Companies constantly experience negative security events – Facebook, Verkada, and Elekta are recent examples. Cybersecurity failures become public relations, customer relations, and financial problems for companies. The problem is many see cybersecurity as a burden that’s required for compliance purposes or is second to other concerns.

Cybersecurity is a complicated issue. However, the focus on what cybersecurity can do, can’t do and how it is perceived is narrowly focused on preventing specific events, with little consideration to larger business ramifications. Treating each event independently leads to a situation where the answer to each incident is to respond by installing a new product or to add a new security policy/procedure. Sure, this can triage a threat, but it may not provide business value to the enterprise.

AppSec/API Security 2022

Cost Center or Business Enabler?

For most, the mindset is to treat all cybersecurity endeavors as either a cost center or a cumbersome requirement mandated by regulations. Perceived benefits are to save money cybercriminals might steal, protect an intangible asset such as a trade secret, mitigate negative press and perform damage control associated with a data breach, or prevent a fine levied as the result of non-compliance. More than likely, cybersecurity costs cover all of these potential outcomes. Additionally, dealing with a breach takes resources away from the business as a whole, and can negatively impact business operations.

For many business cases, cybersecurity is sometimes considered ‘dead weight’ and a loss, and organizations try to limit the expense as much as possible. Other times, security is a cost that companies expect to pay, much like their insurance or electricity bill, or their rent. Security costs, however, should be thought of as a positive for an enterprise, in that it can enable a function or service you wouldn’t otherwise be able to offer because of security concerns.

There is an alternative – and often overlooked – view of cybersecurity costs. The greatest benefit of a strong, robust cybersecurity effort is it offers enterprises a competitive advantage.

One Solution, Two Paths

Security can be a competitive advantage because it allows you to be better than your business competitors. If you and your competitors must meet certain security standards (like PCI, HIPAA or GDPR), and if you can do it more efficiently than your competition, your business gains competitive advantage.  Additionally, that competitive advantage is further enhanced because a strong cybersecurity program encourages business innovation. You can satisfy customer needs without compromising the overall business or customer and user privacy. Creating trust with your customers can pay dividends. People are more likely to gravitate to businesses who demonstrate they are serious about data security and can protect privacy. Having confidence in your cybersecurity program can allow you to provide better services than your competitors, roll out advanced technologies more quickly and, when managed properly, can reduce overall security costs.

There is another competitive rival; one who doesn’t usually show up in a competitive analysis because this opponent isn’t a direct business competitor. The cybercriminal or attacker isn’t trying to take your customers away, but they do want what you have.  Their goal is to steal money, proprietary data or protected information, like credit card numbers. They are competing for these assets, which you want to protect from disclosure just as you protect your proprietary information.  They may want to “borrow” some of your resources (for example, secretly use your servers, email resources or storage). The reason attackers are considered competitors is that, often, they are no longer solo hackers working alone, but are business entities motivated by profit. An attacker ecosystem establishes divisions of labor and many elements are run just as a business would be.

Hackereconomy

This “hackereconomy” has the same goal as all businesses: to maximize profits. The professional, organized cybercriminal wants to spend the minimum amount of resources required to generate the highest possible return. Most attackers target organizations that have less robust security. This is one reason small and medium-sized companies are prime targets. If the amount of effort required to breach a target is too high, attackers will set their sights on other objectives that can generate a greater return. Organizations who have a robust cybersecurity program can make themselves less desirable to attack.

Cybersecurity Is a Business Need

Companies build their own competitive advantage. When cybersecurity is a competitive endeavor, it is possible to make logical decisions, and not just be reactive. In the business realm, companies create a strategy to overcome competition. It is time for enterprises and security professionals to take the same approach to cybersecurity to provide competitive advantage against cybercriminals. Stop looking for the boogeyman, and instead look for a competitor. Cybersecurity leaders must create strategies that will protect the enterprise from most attackers and also allow the organization to successfully accomplish its overall mission.

Featured eBook
Managing the AppSec Toolstack

Managing the AppSec Toolstack

The best cybersecurity defense is always applied in layers—if one line of defense fails, the next should be able to thwart an attack, and so on. Now that DevOps teams are taking  more responsibility for application security by embracing DevSecOps processes, that same philosophy applies to security controls. The challenge many organizations are facing now ... Read More
Security Boulevard

Charles Kolodgy

“Charles J. Kolodgy is a security strategist, visionary, forecaster, historian, educator, and advisor who has been involved in the cyber security field for over 25 years. He is an Analyst with Accelerated Strategies Group and Principal at Security Mindsets. His views and understanding of information and computer security were shaped during his years at the National Security Agency. During that time he held a variety of analyst and managerial positions within both the information assurance and operations directorates. Following NSA is was a a Research Vice President covering security markets for IDC and then a Senior Security Strategist for IBM Security. Over the years he has identified market trends and authored numerous documents to explain market realities and has been a speaker at many security conferences and events, including the RSA Conference, CIO Conference, CEIG, and IANS. He has been widely quoted in the media. He is best known for naming and defining the Unified Threat Management (UTM) market which continues to be one of the strongest cyber security markets with vendor revenue of $3 billion per year. He has been a leading analyst on software security, encryption, and the human element. Charles holds a B.A. in Political Science from the University of Massachusetts at Lowell and an M.A. in National Security Studies from Georgetown University.”

charles-kolodgy has 15 posts and counting.See all posts by charles-kolodgy