Vulnerabilities / Threats

2/14/2018
02:00 PM
Greg Kushto
Greg Kushto
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Tips to Keep Cybersecurity Front & Center

In today's environment, a focus on cybersecurity isn't a luxury. It's a necessity, and making sure that focus is achieved starts with the company's culture.

For IT departments — especially in large organizations — daily operations are complex, multifaceted, and often overwhelming. With so many different demands requiring attention, cybersecurity easily gets lost in the shuffle, particularly when it's perceived to create more work or extra steps. But in today's risk environment, keeping cybersecurity front and center is not a luxury — it's a critical necessity. Like a reserve parachute or a water hydrant, cybersecurity is an organizational must-have, often forgotten until needed, but imperative to survival.

Ideally, your organization's IT department focuses on preventing fires instead of putting them out post facto. Achieving this requires keeping cybersecurity central to your organization's decision-making. But how do you make that happen?

1. Close the Skills Gap
There was a time when it was enough for cybersecurity professionals to train in a standardized protocol or two, monitor the system, and address problems as they arose. This approach is no longer enough, and it hasn't been for years.

Software automation and the outsourcing of certain priorities (such as cloud storage) have resulted in the traditional role of the cybersecurity specialist to appear less imperative. To add value, cybersecurity professionals need to be more than just order-takers. Today's risk environment requires creative decision makers — experts who are comfortable synthesizing information from a number of sources and choosing the best course for addressing an organization's cybersecurity needs.

Unfortunately, there's a significant shortage of such experts in today's market. While earlier cybersecurity systems may have been simple enough for one or two specialists to manage, the complexity of the modern landscape means we need more people with constantly evolving skill sets to cover emerging concerns.

To keep up, organizations must assess any skill gaps on their IT teams and fill them. If immediate hiring isn't feasible, bridge the divide by providing supplemental training, tools, and third-party resources to your existing personnel. There are many fronts to cover, and organizations should know their own weaknesses if they hope to overcome them.

2. Involve Your Security Team
As today's cybersecurity experts evolve into tomorrow's creative decision makers, they should also gain more influence in the boardroom. But that won't happen overnight — and it won't happen without proactive measures taken by cybersecurity professionals themselves.

The security team has to make itself heard. Security touches all aspects of the business, from hiring to operations, so the experts leading that charge need to clearly communicate their perspectives to business leaders. This should not only take place in the middle of a breach or other urgent challenge, but in all discussions. An organization's technology experts have an invaluable vantage point thanks to their intimate knowledge of organizational structure, information flow, operational process, and so much more. Leadership has every reason to value their perspective.

The C-suite may take time to better leverage this expertise — and that's OK. It will happen. By highlighting the dangers of security breaches and the efficiencies created by good security practices, cybersecurity professionals can prove the importance of integrating security measures throughout organizational decision-making and its powerful effect on the bottom line. And that's a language everyone understands.

3. Create a Culture around Security
While a strong security approach needs leadership buy-in, that's by no means the end of the battle. The best cybersecurity is preventative, and one of the main risks to mitigate is human error. That means keeping security top-of-mind for every user at every endpoint. It's a daunting task, to be sure, but by no means impossible.

This can start as early as the hiring process. Make sure that human resources understands how to properly vet potential employees by showing them how to spot characteristics and details in the background check that may leave individuals open to being compromised by blackmailers. During the interview process, try to gauge whether the candidate grasps basic security best practices, whether they can spot phishing attempts or perhaps even whether they're someone likely to leave passwords written on a sticky note by their computer.

For all employees, don't let security training become just another checkbox. Ensure that staff are given regular and meaningful training on the latest scams. Better yet, communicate with them as threats arise and evolve. We all need regular reminders to remain vigilant against an ever-evolving world of security risks.

It takes a lot of hard work, and even so, a completely airtight cybersecurity culture is never 100% possible. But risk mitigation, as always, is the real goal here. Preempting risk requires cultural buy-in, not to mention an organization-wide commitment to making cybersecurity front and center.

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Related Content:

Greg Kushto joined Force 3 in 2014 and is the Vice President of Sales Engineering. In this role, he is responsible for creating comprehensive security solutions for Force 3's client base within both the public and private sector, and ensuring that customers properly align ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-13435
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest w...
CVE-2018-13446
PUBLISHED: 2018-08-16
** DISPUTED ** An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. ...
CVE-2018-14567
PUBLISHED: 2018-08-16
libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.
CVE-2018-15122
PUBLISHED: 2018-08-16
An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a compiled .NET object (such as DLL or EXE) with an embedded resource file by clicking on the resource.
CVE-2018-11509
PUBLISHED: 2018-08-16
ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online repository. This may allow an attacker to login and upload a webshell.