Is Cybersecurity Different in Government Than in Private Sector?
By SilverSky
March, 2023
That question is asked often. However, any question about differences between sectors depends on how we analyze the properties for comparison. In many obvious ways, no differences exist between for the public and private sectors. Cyber is cyber, and cybersecurity goals are the same for government and private organizations that must manage risk and protect themselves from evolving threats.
Moreover, any question about what is happening in another sector (or industry) is a partial distraction, while sector threats are unknown. Organizations can be overwhelmed if they rely too much on aggregate data and trends. What happens in the aggregate will happen only to some organizations. Government and private organizations must start with local knowledge. Cybersecurity leadership begins by understanding an organization’s personnel, infrastructure, assets, and threats, which means understanding local information and signals and acting locally. When local knowledge is acquired, work toward understanding global signals can begin. For example, threat intelligence offers organizations external information about and between sectors and industries that can be assimilated into those organizations’ continuous security lifecycles.
On the other hand, the government and private sectors deviate in different ways. The authors have helped many private sector cybersecurity leaders analyze return on investment to justify the cost of security products and services to management teams and corporate boards, despite the effort containing no value. One cannot know the priori threat an organization faces, its consequences, or its cost. These calculations are guesswork, and no one should take them too seriously. Despite this, the private sector needs help to consider anything that fails to generate revenue as valuable, including cybersecurity. This misfortune is not a problem in government due to no revenue or profit-and-loss statements. Instead, the government has public funds, executive orders, and other directives that mandate security. The private sector utilizes mandates instead of building support organically and discovering new and unique ways security can support business functions. The over-reliance on directives can create a false sense that security has been accomplished with the stroke of a pen instead of seeing cybersecurity as a human and technological response to a constantly evolving digital threat.
Some aspects of the government sector consider aspects of the security problem that no company would consider. For example, the National Security Agency (NSA) protects natural security systems. Organizations like Department of Homeland Security(DHS), Cybersecurity and Infrastructure Security Agency (CISA), and Cybercom protect critical infrastructure and identify best security practices to mitigate global risk, hidden interdependencies, single points of failure, and cascading failures that no single company would contemplate. An alternate way of thinking about the differences is that parts of the federal government dedicate serious thought and action to long and global vulnerabilities and risks. In contrast, a private company almost exclusively thinks and acts short and locally.
The private sector must protect corporate secrets, intellectual property, and personal information, and of course, protect against extortion. The government sector protects national secrets, which tend to attract the attention of sophisticated state actors. What organizations are protecting is different but so is the “why.” The private sector must protect its brand, customers, and shareholders, while the government sector protects citizens, critical infrastructure, and national security. We could go twelve rounds analyzing each aspect of cybersecurity in each sector. However, we would arrive where we started. Cybersecurity (and risk) is the same everywhere you go but in different ways.
About SilverSky
SilverSky understands credit unions and the unique cybersecurity issues they face. Their services are designed to provide communication and collaboration tools combined with state-of-the-art cybersecurity services to protect networks, servers and endpoints.
Compliance expertise helps credit unions meet their regulatory requirements, be it ACET, PCI-DSS or GLBA. SilverSky’s professional services team can provide the assessments and testing to ensure your cybersecurity plan is the best it can be at the most affordable cost.