The warring brothers: five ways security and IT teams can heal the rift

Way back in 1994, during a flagship Oasis gig, the feud between the siblings who made up the band reached such a pitch that younger brother, Liam, threw a tambourine at his older brother’s head. Noel stormed off stage and disappeared for days. Fights among siblings are extremely commonplace and these mirror the issues seen through different parts of the IT department within an enterprise.In fact, recent research from Netskope shows that nearly half of security professionals (46%) and networking professionals (48%) describe their relationship in strongly negative terms. With words like ‘combative’ (13%), ‘dysfunctional’ (10%), ‘frosty’ (10%) and ‘irrelevant’ (10%) used.“The reason for the divide can change from organisation to organisation,” says Jamie Boote, software security consultant at Synopsys Software Integrity Group. He highlights management styles that encourage siloes, regulatory requirements that mandate a separation of duties, along with conflicting incentives and a lack of shared values, as reasons for the rift.But what can security leaders do about it? We’ve done a bit of digging and come up with these five suggestions. 1) Share tools – make savingsOne fundamental problem is IT is mainly incentivised towards uptime, which may disincentivise preventative security. But security drives towards preventative measures and risk reduction.It’s hard to break such conflicting philosophies but one way to get everyone on the same side financially is to maximise budgets by sharing tools across departments. Paul Baird, chief technology security officer UK at Qualys offers the practical example of asset inventory and vulnerability management tools that support network devices as well as endpoint and server infrastructure.“This allows network teams to use existing security solutions rather than purchase their own, which in turn maximises IT budgets and ensures everyone is working from the same data set.” 2) Promote ‘one team’ (even if the boss is different)“The advice for network and security teams is to pull them together as a single team,” says Erick Thek, dedicated intelligence research manager at Trend Micro. “Both groups make a significant contribution towards the total security posture of any organisation. If these teams are not working together, the corporate security strategy is dysfunctional,” he says.There can be differences in reporting lines within organisations that create additional conflict. Sometimes security and networking both report to the CIO. Sometimes there is a dedicated security department reporting to a CISO.“If the CIO is not in charge of the security team, then cross-organisation outreach programmes need to occur where these teams interact and work collaboratively,” says Thek. 3) Make security nuanced and baked inMore collaboration between departments at the start of any projects can help everyone understand the different aims and tackle potential conflicts early. This means baking in security from the outset but may also mean a shift in mindset for security teams. “Security teams should take a more nuanced, risk-based approach rather than looking at things as black and white,” says Paul Baird, chief technology security officer UK at Qualys. “Instead, the team should act as business consultants to work with the networking team, not against them, so that the connectivity and networking side can meet their goals securely.”4) Provide more empathetic leadershipThe cliché about technical teams is that everyone is an analytical problem solver, focused on logic, a Myer-Briggs’ personality type INTJ. Like most clichés there’s a grain of truth. Yet these conflicts suggest that IT leadership needs more emotional intelligence and understanding, says Baird of Qualys.“By understanding how individuals and teams are performing across the business, and how successful they are, CIOs and CISOs can help businesses fulfil their goals more effectively,” he says. 5) Work to better metricsThe work technical teams do – whether in security or networking – will always be a bit of a mystery to the non-technical people who make up the board. This means communicating the right information in the right way to support both teams is critical. In its report around the research, ‘Digital Transformation Needs a More Perfect Union’, Netskope suggests that although “exact metrics will depend on the nature of the business and the maturity of the teams” many CIOs recommend the following:Improved Mean Time to Respond (MTTR); Improved Mean Time to Failure (MTTF) or Mean Time Between Failures (MTBF); Increased Customer Satisfaction (internal or external customers— measured by robust survey)…And that is how you go someway to making Christmas bearable: good communication, more aligned strategies, understanding each others’ aims and shared goals. Oasis, however, are a lost cause…

Your cyber intelligence source

The warring brothers: five ways security and IT teams can heal the rift

Related content

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Home Office Invests in Cyber Risk Strategy

Upcoming Events

The warring brothers: five ways security and IT teams can heal the rift

Related content

OpenAI Fined Over GDPR Failings

Out of Band Patches Released by Adobe Vulnerability

API Flaw Saw McDonald's Driver and Customer Information Vulnerable

LLM Could Generate Thousands of Malware Variants

The Interrelationship Between Cybersecurity and Business Resilience: A New Policy Imperative

Phishing Messages Used DocuSign as a Lure

Home Office Invests in Cyber Risk Strategy

Upcoming Events

Confirm cancellation

Sign up benefits