Following university, I joined the public service, where I started my first desk job. I immediately learnt that sitting at a desk for eight-plus hours a day is not good for my back or my waistline. In response to this, I begrudgingly started structured exercise – a journey that has had its ups and downs, but that continues to this day. In parallel with this physical journey, I fell into a cyber career that has mirrored those physical ups and downs.

Exercise has given me an understanding that sometimes the good things in life can be hard, that there is a difference between being sore and being hurt, and that abs are extremely difficult to obtain. No matter how fit you are, there is always someone more fit; however, your level of fitness is relative to your own personal goals. The same can be said of cyber goals being relative to each organisation’s business objectives.

Cyber has given me an appreciation for how ICT systems work as an ecosystem to achieve a greater business outcome; how you need to unify people, processes, and technology; how the threats will always adapt to the controls; and, of course – as with exercise – how the journey never ends.

Over recent years, the term ‘cyber hygiene’ has become common for articulating the regular, fundamental practices required to help ensure that an ICT environment is secure. It has also been used to describe the health of the organisation, with poor cyber hygiene being attributed to regular breaches, and good cyber hygiene being defined by fewer successful intrusions or interruptions to business. Unfortunately, the use of the word ‘hygiene’ can be deceptive – betraying the effort and work required, and undermining the message.