What drought teaches us about cybersecurity
The Netherlands has a special relationship with water. We build dykes, locks and pumping stations. We measure water levels, monitor risks and prepare for whatever may lie ahead.
After all, water management is not just about excess water. Droughts and low water levels also put pressure on the system. They reveal vulnerabilities that would easily go unnoticed under normal circumstances.
That is precisely where the parallel with cybersecurity lies.
Not in the technology itself, but in the way we deal with risk, visibility, continuity and preparedness.
When circumstances change, risks become apparent
A dyke may appear strong and reliable for many years. However, changing conditions can expose hidden weaknesses. Drought, for example, can lead to cracks and subsidence, thereby further exacerbating existing vulnerabilities.
It’s exactly the same with cybersecurity.
A ransomware attack, a critical vulnerability or a hacked supplier is rarely the whole problem. Such an incident mainly highlights where the digital infrastructure was not adequately mapped, secured or prepared.
Suddenly, fundamental questions turn out to be difficult to answer:
What systems do we have? Which ones are business-critical? How are IT, OT, cloud environments and suppliers interconnected? Who has access? And what happens if a critical component fails?
Once an attack is underway, it is too late to start looking for those answers.
Know where your digital defences are
Organisations are right to invest in firewalls, endpoint security, MFA, SOC services and vulnerability management. These measures are essential.
But they’re only effective if you know what you’re protecting.
Modern cybersecurity therefore begins with visibility. gaining an understanding of assets, identities, network connections, cloud environments, OT systems and the external attack surface.
Not because visibility is an end in itself, but because without visibility you cannot carry out targeted security measures. You cannot prioritise risks, identify anomalies or make sound decisions about remediation.
If you don’t know your digital environment, you won’t know where the dykes are low either.
Protect the entire ecosystem, not just your own dyke
Water knows no boundaries. Neither do cyberattacks.
Your own environment may be well secured, whilst a supplier has access to critical systems. A cloud environment may be incorrectly configured. A forgotten OT device may unexpectedly turn out to be accessible from outside.
Cybersecurity is therefore increasingly an ecosystem issue. An organisation’s resilience is partly determined by the parties, platforms and connections on which it depends.
That is why segmentation and Zero Trust are so important. Not to shut everything down, but to prevent a single incident from spreading unchecked throughout the organisation.
Just as compartments prevent a single breach in a dyke from flooding an entire polder.
Preparing before the water rises
We cannot always prevent droughts. We cannot rule out floods. And we can never completely eliminate cyber risks.
What we can do, however, is be prepared.
Measure. Monitor. Predict. Practise.
And determine in advance what needs to be done if a key system, account or part of the chain fails.
That is cyber resilience:just trying to prevent an attack, but ensuring that the organisation can continue to function and recover quickly. The next step is to learn continuously from every disruption, so that the digital defences are strengthened after every incident.
Over the centuries, the Netherlands has learnt that you shouldn’t wait until the water is at your front door.
Why would we do that in the case of cybersecurity?
Take a look at your digital defences today. Which assets are not being adequately monitored? Which connections do you not fully understand? Where are you dependent on suppliers? And if a digital defence were to fail tomorrow, would you know which floodgates to close?
Don’t wait for high water. Start by observing, measuring and reinforcing.