The role of IT managers has changed dramatically in recent years. In the past they had to play a hands-on role in daily operations. However, today, they have to stand back and take the reins on other priorities. They have to make important decisions that impact everyone in the team, and must act as the face of the department to the wider business and management.
It isn’t just the role of the IT managers that’s evolving quickly. Security has also taken a sudden surge up the IT agenda. Security hasn’t just shaken-up IT departments, but it has taken the entire IT world by storm. Companies now acknowledge that they’re facing constant threats, both new and old, and know they need to take a proactive approach to protect their data. Once more, they need to do this on top of their already frightening workload.
So how has security changed the role of an IT manager? By looking at the capabilities we’ve seen at some our customers, we hope to showcase how IT departments are taking on the challenges that cyber security poses. It’s worth remembering that this isn’t a blueprint for any business, but more a summary of real world examples.
An IT manager should not be a CISO
We see IT managers taking on a Chief Information Security Officer (CISO) or security officer’s role within a company all too often. However, the roles of a Chief Information Officer (CIO) and CISO are strikingly different. While a CIO is primarily responsible for meeting business needs, a CISO has to assess the risk posed by processes. IT is just one part of that task. In an ideal world, a CISO could even report directly into management and would act as a controlling body over IT.
Find the fine line between security and comfort
One of the most important tasks an IT manager has from a security standpoint is to create security awareness and understanding across the organisation. This includes employees, IT and management. While the dream is to make everything as safe as possible, IT managers have to accept that their efforts won’t always work.
By increasing cyber security measures, IT managers often add more complexity to technologies and processes. Of course an IT manager has to be tough on other departments, and must enforce certain actions, but they must also understand that high security standards don’t come naturally to everyone. With this fact in mind, it’s extremely important for IT managers to communicate why security is important and the benefits it can add. The better understanding decision-makers and users have of these measures, the more they’ll want to get involved.
Keep an overall view – documentation is everything
Cyber security is often complex because it essentially affects every asset a company has. From network to storage, to users and processes, everything needs protecting. But in reality 100% protection isn’t possible, especially if the IT manager doesn’t have a complete view of every action that’s taken across the organisation.
The IT department and IT manager need to know what every department within the company is doing and what their daily task-sheet looks like. In addition, it’s extremely important to have precise yet clear documentation on all operations.
Many IT security incidents are caused by shadow IT, and these incidents are harder to resolve if there’s a lack of documentation. Though it may seem time-consuming to develop, documentation makes life easier in the long run.
Have partners you trust on-board
The current threat landscape and the resulting demands on companies can’t really be stopped. For this reason, an IT manager should always have a trusted partner on-hand. This means certain tasks can be outsourced. Even better, there’s someone who can offer help if something happens. IT managers should have people to get in touch with who can provide advice on:
- Reviews. Every IT security concept needs reviewing regularly by an external entity. Most companies can benefit greatly from the experience of other companies, and that’s what a partner can bring to the table. In addition, positive audit results are always useful to showcase the great work of the IT department.
- Managed security services. While it makes no sense to outsource every element of IT security, it might be helpful to out-task certain services. A typical example of this would be using a partner to monitor Security Information and Event Management (SIEM) systems or network traffic. These tasks can be complex and for better protection, they’re required 24/7. A managed security provider can provide these services round-the-clock for an affordable, monthly fee.
- Incident response. Even when they’re handling an incident, an IT manager should be prepared. It’s sometimes necessary to track and assess damage, or even restore systems. Where these measures are required, a trusted partner can really help, especially when SLAs have been clearly defined.
IT security is difficult to handle and master, and can be even more challenging if you’re an IT manager. Many IT managers are now afraid of being personally blamed if something happens. But you can proactively counteract this fear by following some of the steps listed above.
Recently, we told a CEO that he shouldn’t measure his IT manager by what he and his team could protect against. This is because not every threat can be fended off. We would measure him by how he deals with the most critical emergency situations.
