Vulnerabilities / Threats

2/14/2018
02:00 PM
Greg Kushto
Greg Kushto
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

3 Tips to Keep Cybersecurity Front & Center

In today's environment, a focus on cybersecurity isn't a luxury. It's a necessity, and making sure that focus is achieved starts with the company's culture.

For IT departments — especially in large organizations — daily operations are complex, multifaceted, and often overwhelming. With so many different demands requiring attention, cybersecurity easily gets lost in the shuffle, particularly when it's perceived to create more work or extra steps. But in today's risk environment, keeping cybersecurity front and center is not a luxury — it's a critical necessity. Like a reserve parachute or a water hydrant, cybersecurity is an organizational must-have, often forgotten until needed, but imperative to survival.

Ideally, your organization's IT department focuses on preventing fires instead of putting them out post facto. Achieving this requires keeping cybersecurity central to your organization's decision-making. But how do you make that happen?

1. Close the Skills Gap
There was a time when it was enough for cybersecurity professionals to train in a standardized protocol or two, monitor the system, and address problems as they arose. This approach is no longer enough, and it hasn't been for years.

Software automation and the outsourcing of certain priorities (such as cloud storage) have resulted in the traditional role of the cybersecurity specialist to appear less imperative. To add value, cybersecurity professionals need to be more than just order-takers. Today's risk environment requires creative decision makers — experts who are comfortable synthesizing information from a number of sources and choosing the best course for addressing an organization's cybersecurity needs.

Unfortunately, there's a significant shortage of such experts in today's market. While earlier cybersecurity systems may have been simple enough for one or two specialists to manage, the complexity of the modern landscape means we need more people with constantly evolving skill sets to cover emerging concerns.

To keep up, organizations must assess any skill gaps on their IT teams and fill them. If immediate hiring isn't feasible, bridge the divide by providing supplemental training, tools, and third-party resources to your existing personnel. There are many fronts to cover, and organizations should know their own weaknesses if they hope to overcome them.

2. Involve Your Security Team
As today's cybersecurity experts evolve into tomorrow's creative decision makers, they should also gain more influence in the boardroom. But that won't happen overnight — and it won't happen without proactive measures taken by cybersecurity professionals themselves.

The security team has to make itself heard. Security touches all aspects of the business, from hiring to operations, so the experts leading that charge need to clearly communicate their perspectives to business leaders. This should not only take place in the middle of a breach or other urgent challenge, but in all discussions. An organization's technology experts have an invaluable vantage point thanks to their intimate knowledge of organizational structure, information flow, operational process, and so much more. Leadership has every reason to value their perspective.

The C-suite may take time to better leverage this expertise — and that's OK. It will happen. By highlighting the dangers of security breaches and the efficiencies created by good security practices, cybersecurity professionals can prove the importance of integrating security measures throughout organizational decision-making and its powerful effect on the bottom line. And that's a language everyone understands.

3. Create a Culture around Security
While a strong security approach needs leadership buy-in, that's by no means the end of the battle. The best cybersecurity is preventative, and one of the main risks to mitigate is human error. That means keeping security top-of-mind for every user at every endpoint. It's a daunting task, to be sure, but by no means impossible.

This can start as early as the hiring process. Make sure that human resources understands how to properly vet potential employees by showing them how to spot characteristics and details in the background check that may leave individuals open to being compromised by blackmailers. During the interview process, try to gauge whether the candidate grasps basic security best practices, whether they can spot phishing attempts or perhaps even whether they're someone likely to leave passwords written on a sticky note by their computer.

For all employees, don't let security training become just another checkbox. Ensure that staff are given regular and meaningful training on the latest scams. Better yet, communicate with them as threats arise and evolve. We all need regular reminders to remain vigilant against an ever-evolving world of security risks.

It takes a lot of hard work, and even so, a completely airtight cybersecurity culture is never 100% possible. But risk mitigation, as always, is the real goal here. Preempting risk requires cultural buy-in, not to mention an organization-wide commitment to making cybersecurity front and center.

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Related Content:

Greg Kushto joined Force 3 in 2014 and is the Vice President of Sales Engineering. In this role, he is responsible for creating comprehensive security solutions for Force 3's client base within both the public and private sector, and ensuring that customers properly align ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.