Cybersecurity has been a major challenge for organizations but with the emergence of cyber-physical systems and the internet of things (IoT), cyberthreats are becoming increasingly complicated.
In the event of a breach, as seen during the Equifax, Facebook, and even British Airways cyberattacks, there’s usually a breakdown of trust between policymakers and businesses. As a result, companies are beginning to form cybersecurity alliances to bridge the trust gap and better protect customers at the end of the day.
As of now, there are two types of alliances — operational and normative — both of which aim to secure the future of the internet and digital networks.
Companies can choose to join operational alliances if their objective is to raise cybersecurity levels, structure security practices, or speed up security technology adoption by sharing intelligence and technical data with members of the alliance.
It is an ideal alliance for companies that have a Chief Information Security Officer or security department capable of handling cybersecurity data as the company will be informed of threats and best actions to mitigate them.
For example, the National Cyber Security Alliance launched a program that educates SMEs on how to protect themselves with better cybersecurity structures.
The purpose of normative alliances, on the other hand, is to change the way companies deal with cybersecurity risks.
They tend to advise members and the government about upholding values such as trust and accountability in cybersecurity as well as starting collective actions in favor of peace and nonaggression. An example of this is the recent open letter calling on the G7 government and the leaders to prioritize cybersecurity.
Members of a normative alliance focus more on the world as a whole rather than on a single company or industry with the belief that by working together they are able to create a safer digital environment where they can innovate and protect their clients.
However, companies can sometimes choose not to join an alliance as the laws and policies put their clients or parties at opposing ends, with at least one national government. In other cases, companies might find that action taken by the industry and alliances benefit them sufficiently already and they need to take no action on their own in this regard.
Ultimately, the choice of whether or not to join an alliance must be based upon the company’s own risk tolerance and capacity as not every company needs to have a position in the geopolitics of cybersecurity.
Source: techwireasia
