October is Cybersecurity Awareness Month, but Michael Tanji isn’t celebrating. He said there is little to gain from emphasizing once a year what businesses should preach and practice every hour of the day. Ever heard of a company that observed an annual Profit Month? It wouldn’t last long.
“Everyone surges on Cybersecurity Month, as if the threat predictably goes up just before Halloween,” said Tanji, director of cybersecurity for MxD, the National Center for Cybersecurity in Manufacturing as designated by the U.S. Department of War. “We harp on completing annual training, but nobody said you only had to train once a year. Security culture has confused ‘important’ with ‘special,’ and business has confused ‘special’ with ‘rare.’ We’re worse off for it.”
Whenever a business emphasizes cybersecurity best practices, even in October, it’s doing something important. But the trouble, Tanji said, comes when protecting manufacturing systems and processes gets downgraded to the equivalent of an annual physical.
“Think of it like this: What are the subjects you, as a CEO or business unit leader, talk about on a weekly, if not daily, basis?” he asked. “Operations? Financials? Logistics? Why? Because they’re the most important aspects of your business, correct? When do you talk about cybersecurity? Once a year, watching the same canned video, and only because you’re forced to? This sort of behavior is you telling your people in no uncertain terms that cybersecurity isn’t a topic of importance and doesn’t warrant attention, much less effort.”