Looking back at how enterprise IT guarded and portioned out assets and access back then, it might sound a little like tyranny; but it generally wasn’t.
It was merely the product of a different relationship between technology, IT and end users than what we see today. Back then, stories of cybercriminals and data breaches were far from the public mind, so the average non-technical user’s understanding of cybersecurity was limited.
The IT department’s job was to make computers work and facilitate end users’ jobs while, in the interest of maintaining scrupulous network security, limiting internet access at the level that the network management tools of the era allowed – often an all-or-nothing proposition. Either you were allowed to use it, or you weren’t.
In that era of enterprise computing, the relationship between an IT team/chief information security officer (CISO) and an end user resembled something closer to the relationship a utility company has with a customer.
If you think about your gas, electricity or plumbing, you’ll realize there’s a whole range of things going on behind the scenes to safely and effectively deliver your utilities. Industrial plants and sanitation facilities, citywide and nationwide networks of infrastructure and even the wires and pipes in your home create a sophisticated system that secures the basic foundations of modern living.
But unless you work in one of those industries directly, you probably don’t know much about these systems. Outside of DIYers who take on wiring and plumbing projects themselves, the great majority of your interaction with these service suppliers happens when you’re getting set up or when something breaks.
So went the IT department in the old days. They gave you what you needed to let you do what you needed to, with no assumption that you’d understand the tech behind it and – often – that if you had enough access to mess something up, you probably would.
Now it’s 2020. Rapid advancements in enterprise technology and equally significant shifts in how people interact with it in their everyday lives have meant a few different things. End users now have an unprecedented level of knowledge about how to use technology and, even if they don’t have explicitly technical skills, are using numerous sophisticated devices to perform daily tasks at work and at home.
The technology itself, its potential and the way it is implemented has begun to diverge from its familiar on-premise incarnations. And perhaps paradoxically, at a time when it has never been more important for IT departments to ensure cybersecurity, the preceding factors have made it infinitely more challenging.
By looking at a new framework for understanding how end users relate to technology and to the IT department, and seeing where things go wrong when companies try to implement old-school thinking in the new world of cybersecurity, we’ll have a better idea of what it this all means for the IT pros working to manage and secure infrastructure.
IT Then and Now: Our Era of Constant Change
It’s no secret that the era of a primarily passive end user is over. Here are just a few examples of the changes we’ve seen.
Software and Applications Use
Then: Office employees generally used the basic functions of a limited number of applications – a word processor, a spreadsheet program and maybe a database.
Now: Depending on the role, they might use apps hosted on the cloud – under the purview of their organization or outside of it – for everything from in-office communication to work-specific tasks.
Local Applications vs. in the Cloud
Then: People used work machines only for work, on applications installed directly on machines or on an internal server.
Now: People live a huge portion of their lives online, using personal devices for work matters and work devices for personal matters. They conduct a large portion of this on cloud-based apps that exist on a third party’s infrastructure (which is out in the ether, as far as the user is concerned).
Software Purchasing Process
Then: People with job-specific software needs, like designers, would install Adobe Photoshop or Illustrator on their machines after going through a long chain of forms and justifications to get the license.
Now: If they can’t get what they need quickly and easily, they circumvent work networks entirely.
On Site vs. Remote
Then: Oh and of course, all employees were in the office whenever they were doing their jobs.
Now: People work everywhere – you might be working remotely while reading this.
Things are only getting less centralized and more complicated. For example, people in more technical fields like software development can use Amazon Web Services (AWS) and infrastructure-as-code processes to create an atmosphere of continuous testing and integration of solutions. Weeks-long workflows that once required IT sign-off and support can now be done instantaneously.
So, what does this mean for the future of cybersecurity? Today’s IT department needs to operate less like a utility company and more like a consortium of city planners.