About 2,500 years ago, Chinese military strategist, Sun Tzu, wrote “The Art of War.” In it, he said: “Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat.” Tactics and strategy should always complement each other, and are two sides of the same coin. With each successive large-scale cyber attack, it is slowly becoming clear that ransomware is replacing traditional bank heists, and more importantly, military incursions as these attacks now target the critical infrastructure of the most powerful country on the planet. Understanding the strategy, and tactics of our opponents, as well as the strategy and the tactics we implement as a response are vital to victory.
In the battlefield of cybersecurity, here’s how we define the tactical versus the strategic:
- Strategy defines your long-term goals and how you’re planning to achieve them. In other words, your strategy gives you the path you need toward achieving your organization’s mission.
- Tactics are much more concrete and are often oriented toward smaller steps and a shorter time frame along the way. They involve best practices, specific plans, resources, etc. They’re also called “initiatives.”
