Vulnerabilities / Threats

1/22/2018
10:30 AM
Tim Bandos
Tim Bandos
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

9 Steps to More-Effective Organizational Security

Too often security is seen as a barrier, but it's the only way to help protect the enterprise from threats. Here are tips on how to strengthen your framework.

Having a robust and well-defined organizational security framework — one that focuses on both information technology and security — is crucial for fulfilling business requirements. Too often security can be viewed as a barrier, but ultimately, it's the only way to help protect the enterprise from threats and avoid a data compromise.

Here are nine helpful ways to build out your framework:

1. Take a risk-based approach. It's important to take a risk-based approach, especially with employees. Take time to identify which employees, from the top all the way down, represent the greatest risk if a compromise were to occur. Not every employee is created equal when it comes to risk. Some employees have domain administrative credentials across the whole enterprise. Others are the data custodians of critical information and have a surplus of sensitive trade secrets to maintain. You can make the necessary adjustments later, but determining where the most risk resides should always be one of the first things done in an organization.

2. Provide incentives for good behavior. Another important step, developing a security awareness program, can often feel like an effort in futility. Simply communicating what's expected of an employee from a security perspective or foisting a campaign on users isn't always effective. Organizations commonly deploy one-size-fits-all approaches that rarely succeed in altering employee behavior over time. These types of campaigns don't need to go away — they likely never will — but they should give incentives to participants and reward good behavior. Users shouldn't get shamed for accidentally clicking on a phishing link. Instead, they should feel like they play a pivotal role in strengthening the organizational control of a company.

3. Incorporate technology. That doesn't mean it's not good to take some decision-making work away from employees. If you're relying on an employee to do the right thing all the time, you're going to fail eventually. Some see security as a burden on a user, but it doesn't have to be like that. Technology, the more transparent and seamless the better, can help take the guesswork out of situations. Having a well-balanced security strategy paired with those technologies should be the goal of every enterprise.

4. Stop and think. Employees should learn to adopt a stop-and-think mindset. If an employee receives a phishing email, she should pause and ask herself "Is this something I should be doing?" before clicking through. The routine should become habitual, almost instinctive over time. An employee can be the last link in the security chain, but if that person clicks on something malicious, that chain is broken and has opened up the enterprise to a possible breach.

5. Assign a leader. Depending on the size of a business, it could prove beneficial to assign a security leader to each segment across the organization. The leader can confer with other leaders and collaborate on pressing security issues. Every time users have a question — about a potentially malicious link or any other issue — they should be able to ask someone about it quickly. Without a leader, someone dedicated to answering questions, users could be tempted to click on that link, something that could lead to bad decision-making behavior down the line.

6. Get other departments involved. Organizational security doesn't need to be confined solely to the IT department. It's important to leverage resources you have internally. The marketing department can even play a role. One of the main goals across an organization should be to build a security brand within the company. Tapping into the marketing department, a group of individuals that knows how to position itself, what reaches people, and how to measure it, can be enormously helpful.

7. Set up policies. Some of these suggestions may sound esoteric, but at the end of the day, employees still need to answer to something. That's why policies need to be set up and enacted. If you don't hold employees accountable for their actions — what sites users can browse to, what they're allowed to do on their machine, etc. — all of this will be for naught.

8. Refer to published frameworks. When it comes to published IT management frameworks, there are some great guides already on the books. The National Institute of Standards and Technology (NIST) has some guidance. Control Objectives for Information and Related Technologies, or COBIT, an auditing/compliance framework, can also help outline governance and management practices. Not everything may make sense for your company or your organization, but developing your own policies on the fly is never a great idea. Align with industry best practices; after all, they're considered best practices for a reason.

9. Take your time. There's no reason to rush. This isn't something that happens overnight. It can sometimes take years for a company to deploy a successful security awareness campaign. Corporations too often take a tactical approach while rolling out campaigns when they should be more realistic. Take a strategic approach and plan over the course of several years, not months.

Related Content:

 

Tim Bandos, CISSP, CISA, is Senior Director of Cybersecurity at Digital Guardian. He has more than 15 years of experience in cybersecurity, with expertise in internal controls, incident response, and threat intelligence. Prior to joining Digital Guardian in January 2016, Tim ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.