Separation of duties (aka SoD) is nothing new. Since commerce began business managers recognized the sensibility in not giving one person too much power. It makes easy sense to us that the person who manages the payables is not the cheque signer. We clearly see the logic in not assigning conflicting responsibilities to the same person or group. For example, the entity that audits the processes, is not one day-to-day managing those processes. It makes perfect sense.

Separation of duties is a fundamental tenant in cybersecurity. SoD should be baked into the policy and procedures of your organization so that it spells out what IT tasks should be separated and who will complete them. However, to truly ascertain whether you are compliant, we need to take a step back. We need to look, NOT just at procedures, but rather take a look at your org chart. Do you see IT and Cybersecurity in two separate groups? If not, then you have a problem. Yes, they may sound like they should be two peas in the same pod, but not so. IT support/management and IT security must be different departments with different resources.

Enterprise-level organizations are on board with this and have been for some time. Even smaller organizations with IT departments are recognizing the rationale of hiring specialized cybersecurity talent outside of their IT group. However, one group that has been slow to adapt are Managed Service Providers (MSP).

It’s not hard to understand why. They are a business and want to maximize the dollar spend at each client. So they strive to get the IT services AND cybersecurity services too. To be fair, some MSPs do have separate resources to deal with security and this is good. Not as good as a 3rd party consultation, but better than nothing. Many however, even if they tout themselves as offering IT security services, are really using the same resources that do the IT support... and this is not good.

Here are 5 excellent reasons why your IT team and your cybersecurity team should be different.

#1 - Conflict in Goals – IT is all about creating value. Your IT team is optimizing and innovating to deliver faster, better, simpler technology. They are tasked with enabling teams to work more productively, to drive more leads, to make more sales and to provide the analytics to repeat.

Cybersecurity, on the other hand, protects that value. It seems subtle… creating value vs defending it. However, it is stark in contrast. Cybersecurity is risk management. Risk management is not a peer to IT, rather, IT reports to Risk Management. It's the way it must be.

IT Says: Let’s do it faster. Let’s make it easier. Let’s make it cheaper.

Cybersecurity Says: Let’s double-check that. Let’s control that. Let’s monitor that.

Two different worlds. Cybersecurity and IT are two parallel train tracks and like the trains that run on those tracks, they should never cross to the other track.

#2 - Day-to-day Issues – The simple fact is that IT gets bogged down in day-to-day issues and projects, and security is what gets pushed to the back burner. Help desks are are driven by metrics. How many issues were resolved? How long did it take? How many are left over from yesterday. And when there are just not enough hours in the day… well, there’s always tomorrow to harden security. Until one day tomorrow means walking into a company-wide ransomware attack. We cannot be complacent with our IT security and your cybersecurity resources should not be dealing with ordinary issues.