Vulnerabilities / Threats

1/22/2018
10:30 AM
Tim Bandos
Tim Bandos
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

9 Steps to More-Effective Organizational Security

Too often security is seen as a barrier, but it's the only way to help protect the enterprise from threats. Here are tips on how to strengthen your framework.

Having a robust and well-defined organizational security framework — one that focuses on both information technology and security — is crucial for fulfilling business requirements. Too often security can be viewed as a barrier, but ultimately, it's the only way to help protect the enterprise from threats and avoid a data compromise.

Here are nine helpful ways to build out your framework:

1. Take a risk-based approach. It's important to take a risk-based approach, especially with employees. Take time to identify which employees, from the top all the way down, represent the greatest risk if a compromise were to occur. Not every employee is created equal when it comes to risk. Some employees have domain administrative credentials across the whole enterprise. Others are the data custodians of critical information and have a surplus of sensitive trade secrets to maintain. You can make the necessary adjustments later, but determining where the most risk resides should always be one of the first things done in an organization.

2. Provide incentives for good behavior. Another important step, developing a security awareness program, can often feel like an effort in futility. Simply communicating what's expected of an employee from a security perspective or foisting a campaign on users isn't always effective. Organizations commonly deploy one-size-fits-all approaches that rarely succeed in altering employee behavior over time. These types of campaigns don't need to go away — they likely never will — but they should give incentives to participants and reward good behavior. Users shouldn't get shamed for accidentally clicking on a phishing link. Instead, they should feel like they play a pivotal role in strengthening the organizational control of a company.

3. Incorporate technology. That doesn't mean it's not good to take some decision-making work away from employees. If you're relying on an employee to do the right thing all the time, you're going to fail eventually. Some see security as a burden on a user, but it doesn't have to be like that. Technology, the more transparent and seamless the better, can help take the guesswork out of situations. Having a well-balanced security strategy paired with those technologies should be the goal of every enterprise.

4. Stop and think. Employees should learn to adopt a stop-and-think mindset. If an employee receives a phishing email, she should pause and ask herself "Is this something I should be doing?" before clicking through. The routine should become habitual, almost instinctive over time. An employee can be the last link in the security chain, but if that person clicks on something malicious, that chain is broken and has opened up the enterprise to a possible breach.

5. Assign a leader. Depending on the size of a business, it could prove beneficial to assign a security leader to each segment across the organization. The leader can confer with other leaders and collaborate on pressing security issues. Every time users have a question — about a potentially malicious link or any other issue — they should be able to ask someone about it quickly. Without a leader, someone dedicated to answering questions, users could be tempted to click on that link, something that could lead to bad decision-making behavior down the line.

6. Get other departments involved. Organizational security doesn't need to be confined solely to the IT department. It's important to leverage resources you have internally. The marketing department can even play a role. One of the main goals across an organization should be to build a security brand within the company. Tapping into the marketing department, a group of individuals that knows how to position itself, what reaches people, and how to measure it, can be enormously helpful.

7. Set up policies. Some of these suggestions may sound esoteric, but at the end of the day, employees still need to answer to something. That's why policies need to be set up and enacted. If you don't hold employees accountable for their actions — what sites users can browse to, what they're allowed to do on their machine, etc. — all of this will be for naught.

8. Refer to published frameworks. When it comes to published IT management frameworks, there are some great guides already on the books. The National Institute of Standards and Technology (NIST) has some guidance. Control Objectives for Information and Related Technologies, or COBIT, an auditing/compliance framework, can also help outline governance and management practices. Not everything may make sense for your company or your organization, but developing your own policies on the fly is never a great idea. Align with industry best practices; after all, they're considered best practices for a reason.

9. Take your time. There's no reason to rush. This isn't something that happens overnight. It can sometimes take years for a company to deploy a successful security awareness campaign. Corporations too often take a tactical approach while rolling out campaigns when they should be more realistic. Take a strategic approach and plan over the course of several years, not months.

Related Content:

 

Tim Bandos, CISSP, CISA, is Senior Director of Cybersecurity at Digital Guardian. He has more than 15 years of experience in cybersecurity, with expertise in internal controls, incident response, and threat intelligence. Prior to joining Digital Guardian in January 2016, Tim ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Google to Delete 'Secure' Label from HTTPS Sites
Kelly Sheridan, Staff Editor, Dark Reading,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "The one you have not seen, won't be remembered".
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-9317
PUBLISHED: 2018-05-23
Privilege escalation vulnerability found in some Dahua IP devices. Attacker in possession of low privilege account can gain access to credential information of high privilege account and further obtain device information or attack the device.
CVE-2018-1193
PUBLISHED: 2018-05-23
Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.
CVE-2018-1122
PUBLISHED: 2018-05-23
procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.
CVE-2018-1123
PUBLISHED: 2018-05-23
procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service).
CVE-2018-1125
PUBLISHED: 2018-05-23
procps-ng before version 3.3.15 is vulnerable to a stack buffer overflow in pgrep. This vulnerability is mitigated by FORTIFY, as it involves strncat() to a stack-allocated string. When pgrep is compiled with FORTIFY (as on Red Hat Enterprise Linux and Fedora), the impact is limited to a crash.