Balancing Innovation and Security: Lessons from George Weston Foods’ CISO
In a conversation with Peter Hind, ADAPT's Principal Research Analyst at Security Edge, Stephen Harris, the Head of IT Customer Solutions and Cyber Security at George Weston Foods, delves into the intricate balance between maintaining robust cyber security and fostering innovation within a dynamic production environment.In a conversation with Peter Hind, ADAPT’s Principal Research Analyst at Security Edge, Stephen Harris, the Head of IT Customer Solutions and Cyber Security at George Weston Foods, delves into the intricate balance between maintaining robust cyber security and fostering innovation within a dynamic production environment.
Stephen shares his strategic approach to integrating security measures without stifling business operations, ensuring that George Weston Foods remains secure and operationally efficient.
Cyber security in a complex production environment
Stephen Harris, overseeing IT projects and cyber security at George Weston Foods, manages daily security operations and strategic planning aligned with business values.
His role is crucial in addressing the unique challenges of maintaining a secure, uninterrupted supply chain for daily essential goods.
Layered security and business engagement
Stephen emphasises the concept of layered security, rejecting the notion of a silver bullet solution.
Instead, he proposes aa multi-layered defence strategy tailored to the business’s specific risks and needs.
He focuses on engaging with other business units to align security measures with the company’s risk appetite and operational needs, which is crucial for maintaining operational continuity.
Proactive security integration
One of Stephen’s key strategies is proactive security integration at the early project and product development stages.
This approach prevents security from being an afterthought, often making it perceived as a barrier to progress.
Embedding security from the start becomes a seamless aspect of the development process, enhancing overall project outcomes without compromising security.
Decision-making and stakeholder trust
Stephen also touches on the importance of collaboration and trust between IT, security, and other business functions, facilitating informed decision-making with clear, value-focused options and recommendations.
This ensures that decisions regarding security investments and priorities are fully aligned with their impact on business operations and objectives.
Navigating challenges and setting priorities
In the face of evolving threats and limited resources, Stephen stresses clear communication and strategic prioritisation.
His team identifies and addresses the most critical risks that could impact the business, ensuring that resources are allocated effectively to manage those risks without unnecessary expenditure.
Key Takeaways:
Strategic Security: Implement a layered security strategy that aligns with business operations and risk tolerance.
Early Integration: Embed security measures early in the project lifecycle to ensure they are integral to the development process and not seen as obstacles.
Collaborative Decision-Making: Foster a culture of trust and collaboration across business units to facilitate informed and strategic decisions about cyber security.
Effective Prioritisation: Focus on high-level risks to ensure that security resources are used efficiently and effectively.