Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/22/2018
10:30 AM
Tim Bandos
Tim Bandos
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

9 Steps to More-Effective Organizational Security

Too often security is seen as a barrier, but it's the only way to help protect the enterprise from threats. Here are tips on how to strengthen your framework.

Having a robust and well-defined organizational security framework — one that focuses on both information technology and security — is crucial for fulfilling business requirements. Too often security can be viewed as a barrier, but ultimately, it's the only way to help protect the enterprise from threats and avoid a data compromise.

Here are nine helpful ways to build out your framework:

1. Take a risk-based approach. It's important to take a risk-based approach, especially with employees. Take time to identify which employees, from the top all the way down, represent the greatest risk if a compromise were to occur. Not every employee is created equal when it comes to risk. Some employees have domain administrative credentials across the whole enterprise. Others are the data custodians of critical information and have a surplus of sensitive trade secrets to maintain. You can make the necessary adjustments later, but determining where the most risk resides should always be one of the first things done in an organization.

2. Provide incentives for good behavior. Another important step, developing a security awareness program, can often feel like an effort in futility. Simply communicating what's expected of an employee from a security perspective or foisting a campaign on users isn't always effective. Organizations commonly deploy one-size-fits-all approaches that rarely succeed in altering employee behavior over time. These types of campaigns don't need to go away — they likely never will — but they should give incentives to participants and reward good behavior. Users shouldn't get shamed for accidentally clicking on a phishing link. Instead, they should feel like they play a pivotal role in strengthening the organizational control of a company.

3. Incorporate technology. That doesn't mean it's not good to take some decision-making work away from employees. If you're relying on an employee to do the right thing all the time, you're going to fail eventually. Some see security as a burden on a user, but it doesn't have to be like that. Technology, the more transparent and seamless the better, can help take the guesswork out of situations. Having a well-balanced security strategy paired with those technologies should be the goal of every enterprise.

4. Stop and think. Employees should learn to adopt a stop-and-think mindset. If an employee receives a phishing email, she should pause and ask herself "Is this something I should be doing?" before clicking through. The routine should become habitual, almost instinctive over time. An employee can be the last link in the security chain, but if that person clicks on something malicious, that chain is broken and has opened up the enterprise to a possible breach.

5. Assign a leader. Depending on the size of a business, it could prove beneficial to assign a security leader to each segment across the organization. The leader can confer with other leaders and collaborate on pressing security issues. Every time users have a question — about a potentially malicious link or any other issue — they should be able to ask someone about it quickly. Without a leader, someone dedicated to answering questions, users could be tempted to click on that link, something that could lead to bad decision-making behavior down the line.

6. Get other departments involved. Organizational security doesn't need to be confined solely to the IT department. It's important to leverage resources you have internally. The marketing department can even play a role. One of the main goals across an organization should be to build a security brand within the company. Tapping into the marketing department, a group of individuals that knows how to position itself, what reaches people, and how to measure it, can be enormously helpful.

7. Set up policies. Some of these suggestions may sound esoteric, but at the end of the day, employees still need to answer to something. That's why policies need to be set up and enacted. If you don't hold employees accountable for their actions — what sites users can browse to, what they're allowed to do on their machine, etc. — all of this will be for naught.

8. Refer to published frameworks. When it comes to published IT management frameworks, there are some great guides already on the books. The National Institute of Standards and Technology (NIST) has some guidance. Control Objectives for Information and Related Technologies, or COBIT, an auditing/compliance framework, can also help outline governance and management practices. Not everything may make sense for your company or your organization, but developing your own policies on the fly is never a great idea. Align with industry best practices; after all, they're considered best practices for a reason.

9. Take your time. There's no reason to rush. This isn't something that happens overnight. It can sometimes take years for a company to deploy a successful security awareness campaign. Corporations too often take a tactical approach while rolling out campaigns when they should be more realistic. Take a strategic approach and plan over the course of several years, not months.

Related Content:

 

Tim Bandos, CISSP, CISA, is Senior Director of Cybersecurity at Digital Guardian. He has more than 15 years of experience in cybersecurity, with expertise in internal controls, incident response, and threat intelligence. Prior to joining Digital Guardian in January 2016, Tim ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7201
PUBLISHED: 2019-05-22
CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel.
CVE-2018-7803
PUBLISHED: 2019-05-22
A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TriStation Emulator V1.2.0, which could cause the emulator to crash when sending a specially crafted packet. The emulator is used infrequently for application logic testing. It is susceptible to an attack...
CVE-2018-7844
PUBLISHED: 2019-05-22
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading memory blocks from the controller over Modbus.
CVE-2018-7853
PUBLISHED: 2019-05-22
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service when reading invalid physical memory blocks in the controller over Modbus
CVE-2018-7854
PUBLISHED: 2019-05-22
A CWE-248 Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a denial of Service when sending invalid debug parameters to the controller over Modbus.