Vulnerabilities / Threats

2/14/2018
02:00 PM
Greg Kushto
Greg Kushto
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Tips to Keep Cybersecurity Front & Center

In today's environment, a focus on cybersecurity isn't a luxury. It's a necessity, and making sure that focus is achieved starts with the company's culture.

For IT departments — especially in large organizations — daily operations are complex, multifaceted, and often overwhelming. With so many different demands requiring attention, cybersecurity easily gets lost in the shuffle, particularly when it's perceived to create more work or extra steps. But in today's risk environment, keeping cybersecurity front and center is not a luxury — it's a critical necessity. Like a reserve parachute or a water hydrant, cybersecurity is an organizational must-have, often forgotten until needed, but imperative to survival.

Ideally, your organization's IT department focuses on preventing fires instead of putting them out post facto. Achieving this requires keeping cybersecurity central to your organization's decision-making. But how do you make that happen?

1. Close the Skills Gap
There was a time when it was enough for cybersecurity professionals to train in a standardized protocol or two, monitor the system, and address problems as they arose. This approach is no longer enough, and it hasn't been for years.

Software automation and the outsourcing of certain priorities (such as cloud storage) have resulted in the traditional role of the cybersecurity specialist to appear less imperative. To add value, cybersecurity professionals need to be more than just order-takers. Today's risk environment requires creative decision makers — experts who are comfortable synthesizing information from a number of sources and choosing the best course for addressing an organization's cybersecurity needs.

Unfortunately, there's a significant shortage of such experts in today's market. While earlier cybersecurity systems may have been simple enough for one or two specialists to manage, the complexity of the modern landscape means we need more people with constantly evolving skill sets to cover emerging concerns.

To keep up, organizations must assess any skill gaps on their IT teams and fill them. If immediate hiring isn't feasible, bridge the divide by providing supplemental training, tools, and third-party resources to your existing personnel. There are many fronts to cover, and organizations should know their own weaknesses if they hope to overcome them.

2. Involve Your Security Team
As today's cybersecurity experts evolve into tomorrow's creative decision makers, they should also gain more influence in the boardroom. But that won't happen overnight — and it won't happen without proactive measures taken by cybersecurity professionals themselves.

The security team has to make itself heard. Security touches all aspects of the business, from hiring to operations, so the experts leading that charge need to clearly communicate their perspectives to business leaders. This should not only take place in the middle of a breach or other urgent challenge, but in all discussions. An organization's technology experts have an invaluable vantage point thanks to their intimate knowledge of organizational structure, information flow, operational process, and so much more. Leadership has every reason to value their perspective.

The C-suite may take time to better leverage this expertise — and that's OK. It will happen. By highlighting the dangers of security breaches and the efficiencies created by good security practices, cybersecurity professionals can prove the importance of integrating security measures throughout organizational decision-making and its powerful effect on the bottom line. And that's a language everyone understands.

3. Create a Culture around Security
While a strong security approach needs leadership buy-in, that's by no means the end of the battle. The best cybersecurity is preventative, and one of the main risks to mitigate is human error. That means keeping security top-of-mind for every user at every endpoint. It's a daunting task, to be sure, but by no means impossible.

This can start as early as the hiring process. Make sure that human resources understands how to properly vet potential employees by showing them how to spot characteristics and details in the background check that may leave individuals open to being compromised by blackmailers. During the interview process, try to gauge whether the candidate grasps basic security best practices, whether they can spot phishing attempts or perhaps even whether they're someone likely to leave passwords written on a sticky note by their computer.

For all employees, don't let security training become just another checkbox. Ensure that staff are given regular and meaningful training on the latest scams. Better yet, communicate with them as threats arise and evolve. We all need regular reminders to remain vigilant against an ever-evolving world of security risks.

It takes a lot of hard work, and even so, a completely airtight cybersecurity culture is never 100% possible. But risk mitigation, as always, is the real goal here. Preempting risk requires cultural buy-in, not to mention an organization-wide commitment to making cybersecurity front and center.

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Related Content:

Greg Kushto joined Force 3 in 2014 and is the Vice President of Sales Engineering. In this role, he is responsible for creating comprehensive security solutions for Force 3's client base within both the public and private sector, and ensuring that customers properly align ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Charlie Miller, Senior Vice President, The Santa Fe Group,  5/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11232
PUBLISHED: 2018-05-18
The etm_setup_aux function in drivers/hwtracing/coresight/coresight-etm-perf.c in the Linux kernel before 4.10.2 allows attackers to cause a denial of service (panic) because a parameter is incorrectly used as a local variable.
CVE-2017-15855
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in u...
CVE-2018-3567
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing the HTT_T2H_MSG_TYPE_PEER_MAP or HTT_T2H_MSG_TYPE_PEER_UNMAP messages.
CVE-2018-3568
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, in __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur.
CVE-2018-5827
PUBLISHED: 2018-05-17
In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in WLAN while processing an extscan hotlist event.