Cybersecurity and global security: a useful convergence.
The cybersecurity budget represents a significant cost in overall security. Furthermore, the legal and financial risks associated with cybersecurity are substantial for the company. The statistics speak for themselves: 79% companies have already suffered a cyberattack [i], which has In 50% cases, there is a direct impact on revenue.. Another striking statistic demonstrates the importance of cybersecurity in corporate security: 60% Small businesses cease operations 6 months after a cyberattack.[ii] It is also interesting to note that the subject of cybersecurity is raised by Prefect BURG in the prospective overview of private security.[iii]
Nevertheless, the CISO [iv] The IT professional is often perceived as a restrictor of freedom rather than a key player in overall security. This is also evident in the reporting structure of CISOs, who are frequently subordinate to the Chief Information Officer.
Furthermore, as we can see from the standard ISO27002, Physical and environmental security are integral parts of cybersecurity. However, communication between the security control center (fire and safety) and the CISO is often nonexistent. This is paradoxical in several cases., Let's take the example of fire safety. It is increasingly common for fire safety (through fire safety systems) and security control centers (logbooks, video surveillance, access management via badges) to be dependent on IT and therefore on cybersecurity through the DICT criteria[v].
Attack methods These too are becoming less and less sector-specific, and the sources of attacks increasingly diverse. Thus, the methods related to social engineering are at the intersection of cybersecurity and overall security. Examples include CEO scams which use a computer-based approach combined with methods of gathering corporate intelligence. Conversely, one can also mention physical intrusions linked to cyber intelligence (website, call for tenders with plan, …) or related to IT system unavailability managing access via badge. Threats related to geopolitical issues, Whether they are terrorist or from a third state, they also threaten computer security and the news unfortunately reflects this.
The response to these multiple threats This is done at the state level by state security services. While in most companies IT security is managed by the CIO, state IT security is not managed by IT departments.’ANSSI[vi] is thus attached to SGDSN[vii], The offensive capability is attached to the army, and the judicial investigation capability is attached to the police and gendarmerie services.
At the company level, Responding to major cyber incidents involves all of the company's departments. who find themselves within a crisis cell similar in its overall structure to the majority of crises.
The services of Cyber Threat Intelligence [viii] suggested by cybersecurity specialists They can also be used for overall company security. Indeed, CTI can highlight a greater number of cyber threats: early warning signs of a risk of physical attack or an attack targeting the company's image.
A set of methodologies are relatively similar between cybersecurity and overall security, This is particularly relevant in the context of risk analysis or crisis management. Therefore, it can be beneficial to establish cross-functional centers of expertise bridging cybersecurity and overall security.
All of these elements together constitute the arguments that support a long-term integration of IT security into the safety/security departments or the general management. An organization that is, moreover increasingly popular among IT security professionals.
This entails profound changes in the cybersecurity organization; therefore, this approach must stem from a genuine commitment from senior management as well as specialized departments. Nevertheless, it may prove necessary, initially, to link the CISO to the IT department in order to advance operational issues, and to promote CIO/CISO contact. A more centralized reporting structure can be implemented later, allowing for a comprehensive approach to security.
Credits
Author : Yann BORTOLUZZI, INTRINSEC Crisis Management Consultant.
Supervision : Pauline DONON, Senior Managing Consultant INTRINSEC.
[i] CESIN Cybersecurity Barometer Wave 3 January 2018
[ii] https://www.cyber-cover.fr/cyber-documentation/cyber-securite/cybersecurite-statistiques-que-toute-pme-devrait-connaitre
[iii] www.interieur.gouv.fr/content/download/107828/856816/file/panorama-prospectif-securite-privee-2025.pdf
[iv] Information Systems Security Manager
[v] Availability, Integrity, Confidentiality, Traceability
[vi] National Cybersecurity Agency
[vii] General Secretariat for Defence and National Security
[viii] Cyber Threat Intelligence: CTI
