IT and security teams share tasks in identity management, data governance, and cloud management. These domains are key for any organization due to their influence on both efficiency and security.
IT handles user account provisioning while security makes sure access is controlled and compliant with security standards. Both teams must coordinate on these shared tasks to avoid conflicting objectives.
When IT focuses on uptime and accessibility while security prioritizes risk mitigation, tensions can arise. Without an intentional focus on cooperation, these areas become less effective, as Kristi Preuss (Deloitte) warns.
The tension between IT and security arises primarily from differing priorities. IT prioritizes efficiency and user accessibility, while security is focused on risk management. With cyberattacks increasing in sophistication, the pressure to act quickly creates a further divide.
If left unresolved, this conflict can lead to inefficiencies and vulnerabilities.
Organizations need to put structures in place that encourage joint decision-making, ensuring both teams work towards a common objective.
Aligning IT and security to fuel business success
Unified goals
For both teams to succeed, they need to align their objectives with broader business targets. Whether protecting data during a cloud migration or ensuring that uptime is maintained, both IT and security must work together to meet deadlines, budgets, and business needs.
Dan Lohrmann (Presidio) emphasizes that the alignment of IT and security is necessary to make sure projects move forward without compromising key data or security. A unified approach ensures a resilient infrastructure that supports long-term growth.
CTO and CISO leadership
The relationship between the CTO and CISO is key to creating cooperation between IT and security teams. Their ability to communicate a shared vision and goals is key. When the CTO and CISO are aligned, their teams will naturally follow. It requires regular communication, shared planning, and an understanding of each other’s priorities.
The secrets to IT and security teamwork
Clear communication and transparency are key for IT and security to collaborate. Sharing information and challenges openly helps build trust and ensures both teams work towards common goals. Kristi Preuss stresses that transparency is the foundation for successful teamwork, particularly when the teams are working on tasks like system security updates.
Building trust takes time but can be accelerated through regular communication, shared tools, and joint problem-solving sessions. When both teams feel their concerns are taken seriously, collaboration improves naturally.
Joint resilience drills
Resilience drills, such as cyberattack simulations, offer valuable opportunities for IT and security teams to collaborate. Exercises prepare both groups for real-world scenarios, improving their ability to respond quickly and efficiently.
Drills test team dynamics, allowing organizations to identify weaknesses in current protocols and refine them before a real emergency occurs. Joint exercises also help build mutual understanding between the teams.
Accepting progress over perfection
Balancing the drive for operational efficiency with security is an ongoing challenge. IT often prioritizes speed and functionality, while security teams aim for rigorous safeguards that can slow progress.
Mike Scott (Immuta) emphasizes the need for compromise, focusing on steady improvement rather than perfection.
Both teams should agree on an acceptable level of risk and work towards securing systems in a way that doesn’t impede operational goals. Such an approach allows for flexibility, giving the organization the ability to stay agile while improving its security posture incrementally.
Unified planning
Effective planning from the outset is key. Both teams must contribute to project timelines, resource allocation, and risk management. Having a unified plan in place helps ensure that when challenges arise, they can be addressed without disrupting progress.
Cross-training and simulations that bring IT and security together
Running simulations like disaster recovery scenarios helps IT and security teams practice working together in high-pressure situations. Jeff Orr (ISG) advocates for simulations that require both teams to respond, leading to better communication and coordination.
Exercises create an environment where teams can identify gaps in communication and workflow, while also gaining a deeper understanding of how their roles intersect.
Cross-training strengthens the collaborative capabilities of IT and security teams by exposing them to each other’s roles. This creates a mutual understanding and makes sure that in a crisis, team members can step in where needed.
When gaining insights into each other’s workflows, IT and security teams become more effective in their joint efforts.
The role of industry standards and tailored training
Industry frameworks such as NIST Cyber Framework and IT Infrastructure Library (ITIL) provide valuable structures for collaboration between IT and security. Regular, tailored training helps both teams stay up to date on the latest industry practices, ensuring they can work together effectively. Dan Lohrmann highlights the importance of adapting these standards to fit the specific needs of the organization.
Guidelines provide a framework and help create a common language, which is essential for smooth collaboration.
Conflict resolution that works
Having clear policies for conflict resolution helps ensure that disputes between IT and security teams are handled quickly and fairly. A structured process, such as a dedicated committee for handling disputes, as used in Michigan’s state government, can resolve conflicts before they impact projects or security efforts.
Established procedures reduce the risk of long-lasting disagreements and promote a smoother working relationship between both teams.
How to spot and solve IT-security issues fast
When misalignment occurs between IT and security teams, quick intervention is essential. Sharon Chand (Deloitte) highlights that allowing issues to persist leads to inefficiencies and security vulnerabilities. Management must monitor for signs of misalignment and take swift action to restore collaboration.
This approach addresses current issues and prevents future conflicts, making sure that teams remain focused on shared objectives.
How to reward IT and security collaboration
Recognizing and celebrating the collaboration between IT and security teams is essential for fostering long-term cooperation. Jeff Orr points out that these teams often play a key role in preventing major security breaches, and their successes should be highlighted across the organization.
Celebrating their achievements boosts morale and encourages continued cooperation, reinforcing the importance of cross-team collaboration.
Public recognition, whether through internal announcements or company-wide events, strengthens a culture of teamwork and sets an example for the entire organization.
