Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/22/2018
10:30 AM
Tim Bandos
Tim Bandos
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

9 Steps to More-Effective Organizational Security

Too often security is seen as a barrier, but it's the only way to help protect the enterprise from threats. Here are tips on how to strengthen your framework.

Having a robust and well-defined organizational security framework — one that focuses on both information technology and security — is crucial for fulfilling business requirements. Too often security can be viewed as a barrier, but ultimately, it's the only way to help protect the enterprise from threats and avoid a data compromise.

Here are nine helpful ways to build out your framework:

1. Take a risk-based approach. It's important to take a risk-based approach, especially with employees. Take time to identify which employees, from the top all the way down, represent the greatest risk if a compromise were to occur. Not every employee is created equal when it comes to risk. Some employees have domain administrative credentials across the whole enterprise. Others are the data custodians of critical information and have a surplus of sensitive trade secrets to maintain. You can make the necessary adjustments later, but determining where the most risk resides should always be one of the first things done in an organization.

2. Provide incentives for good behavior. Another important step, developing a security awareness program, can often feel like an effort in futility. Simply communicating what's expected of an employee from a security perspective or foisting a campaign on users isn't always effective. Organizations commonly deploy one-size-fits-all approaches that rarely succeed in altering employee behavior over time. These types of campaigns don't need to go away — they likely never will — but they should give incentives to participants and reward good behavior. Users shouldn't get shamed for accidentally clicking on a phishing link. Instead, they should feel like they play a pivotal role in strengthening the organizational control of a company.

3. Incorporate technology. That doesn't mean it's not good to take some decision-making work away from employees. If you're relying on an employee to do the right thing all the time, you're going to fail eventually. Some see security as a burden on a user, but it doesn't have to be like that. Technology, the more transparent and seamless the better, can help take the guesswork out of situations. Having a well-balanced security strategy paired with those technologies should be the goal of every enterprise.

4. Stop and think. Employees should learn to adopt a stop-and-think mindset. If an employee receives a phishing email, she should pause and ask herself "Is this something I should be doing?" before clicking through. The routine should become habitual, almost instinctive over time. An employee can be the last link in the security chain, but if that person clicks on something malicious, that chain is broken and has opened up the enterprise to a possible breach.

5. Assign a leader. Depending on the size of a business, it could prove beneficial to assign a security leader to each segment across the organization. The leader can confer with other leaders and collaborate on pressing security issues. Every time users have a question — about a potentially malicious link or any other issue — they should be able to ask someone about it quickly. Without a leader, someone dedicated to answering questions, users could be tempted to click on that link, something that could lead to bad decision-making behavior down the line.

6. Get other departments involved. Organizational security doesn't need to be confined solely to the IT department. It's important to leverage resources you have internally. The marketing department can even play a role. One of the main goals across an organization should be to build a security brand within the company. Tapping into the marketing department, a group of individuals that knows how to position itself, what reaches people, and how to measure it, can be enormously helpful.

7. Set up policies. Some of these suggestions may sound esoteric, but at the end of the day, employees still need to answer to something. That's why policies need to be set up and enacted. If you don't hold employees accountable for their actions — what sites users can browse to, what they're allowed to do on their machine, etc. — all of this will be for naught.

8. Refer to published frameworks. When it comes to published IT management frameworks, there are some great guides already on the books. The National Institute of Standards and Technology (NIST) has some guidance. Control Objectives for Information and Related Technologies, or COBIT, an auditing/compliance framework, can also help outline governance and management practices. Not everything may make sense for your company or your organization, but developing your own policies on the fly is never a great idea. Align with industry best practices; after all, they're considered best practices for a reason.

9. Take your time. There's no reason to rush. This isn't something that happens overnight. It can sometimes take years for a company to deploy a successful security awareness campaign. Corporations too often take a tactical approach while rolling out campaigns when they should be more realistic. Take a strategic approach and plan over the course of several years, not months.

Related Content:

 

Tim Bandos, CISSP, CISA, is Senior Director of Cybersecurity at Digital Guardian. He has more than 15 years of experience in cybersecurity, with expertise in internal controls, incident response, and threat intelligence. Prior to joining Digital Guardian in January 2016, Tim ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13961
PUBLISHED: 2019-07-18
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVE-2019-13962
PUBLISHED: 2019-07-18
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-10101
PUBLISHED: 2019-07-18
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
CVE-2019-10102
PUBLISHED: 2019-07-18
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersControlle...
CVE-2019-10102
PUBLISHED: 2019-07-18
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suric...