Who Is The Cybersecurity Guy In Your Organisation?

Too often, IT teams, if they address it at all, take a conventional approach to cybersecurity: lock all the doors, build a great firewall, restrict access, and eliminate any intruders. In today’s world, this is no longer sufficient or appropriate. Over the last few years, approaches to cyber-defense have, out of necessity, changed.

However, a few myths still permeate the debate. Most notably the ideas that 
1. Any problem can be solved by throwing a sufficient amount of money at it. 
2. That isolating yourself and securing only your own networks still in some way provides you with a competitive advantage. These myths in particular reflect poorly on companies’ ability to understand the future of the threat landscape.

Interestingly, the lack of clarity on the mandates and responsibilities for security within an organization rarely rank highly during company surveys of the primary barriers to ensuring an effective information security strategy is implemented.  Instead, external factors such as the increased sophistication of threats and emerging technologies are seen as the greatest challenges.

In line with this trend to underestimate the need for clear guidance on who should do what within an organization, various surveys often find that executives overestimate their companies’ ability to deal with cyber-attacks. In a recent survey, company employees showed extraordinary public confidence in their CEOs’ and directors’ security strategies. Despite industry research showing that it typically takes an average of 200 days to discover an attack on a network, 55% of the aforementioned respondents believed they could detect a breach within a matter of days; 25% answered a matter of hours.

Certainly, the threat landscape has changed, and we are ever more confident in the fact that new kit and gadgets can provide us with real-time snapshots of the activity on our networks. Cybersecurity software has also got clever: programs will learn patterns to stay ahead – intelligent locks if you like.

However, when dealing with an organization, be it large or small, cybersecurity has to start somewhere: with your employees. Account takeover remains the easiest way to enter a network. No need to force your way in through a complex web of security traps thought up by some savvy IT professional. Simply guess (rather intelligently in some cases through targeted open-source research) someone’s password and pivot your way through the network till you find what you’re looking for. If you’re lucky, an insider, preferably with administrator privileges, will even help you out whether they know it or not.

Training and direction remain some of the more essential components of a company’s security plan. Not only do we, in the United Kingdom, suffer from a shortage of skills within the cybersecurity industry itself, we also suffer from a lack of awareness of how to approach it on a day-to-day basis.
This is true at all levels of an organization. The board of directors is tasked with the responsibility of overseeing risk management – including cyber-risks – for shareholders, and yet many boards do not have any person or group on the board that possesses cybersecurity skills and is capable of functioning in that capacity. According to a 2014 board survey, 29% of corporate boards are not briefed on cybersecurity at all, while 30% are briefed once a year. The same survey found that 60% of companies do not have a Chief Cybersecurity or Chief Information Officer, and 61% of those companies allow cybersecurity duties to fall to the Chief Financial Officer.

We’ve established that employees need to have a basic understanding of their footprint on the network: which passwords they use, what files they should open or not, what information should be reported, and how to report that information. As a general rule, however, cybersecurity is not just a problem for a company’s IT department. As an organization-wide issue, companies must recognize that (1) not all data can be protected to a gold standard, (2) data that matters should be heavily protected and sufficiently isolated from a network’s weak points, and (3) not everyone is best placed to determine what data is important.

Overall, the board of directors and company Officers need to be supported in their risk management duties by competent security professionals who not only have a technical awareness of the issues at hand but, are also aware of the daily business practicalities that this entails.

Cybersecurity is everyone’s responsibility: the board must provide an informed overarching strategy to protect shareholders’ interest; the Officers must be kept up to date with latest trends and developments to keep both their IT staff and their other employees informed; and employees need to be made aware of the risk they could pose to their company’s network. Prioritizing the importance of data, based on its financial value and/or reputational attributes, remains a key consideration when handling both proprietary or third-party data.
Infosecurity: http://bit.ly/1RBQQC8

 

« Four Startup Companies That Are Harnessing AI In The Invisible Cyberwar
How The CIA Is Making Sense Of Big Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Falanx Cyber

Falanx Cyber

Falanx Cyber provides enterprise-class cyber security services and solutions. We deliver end-to-end cyber capabilities, either as specific engagements or as fully-managed services.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

Gilbert + Tobin

Gilbert + Tobin

Gilbert + Tobin is an Australian corporate law firm serving clients throughout Australia, and around the world, on a broad range of legal issues including cyber security.

Miradore

Miradore

Miradore is a software company specializing in effective, cloud-based device management. Our goal is to help IT Service Providers and IT departments secure and control devices.

APERIO

APERIO

APERIO, the global leader in industrial data integrity, helps its customers drive profitability and sustainability while mitigating risk in their industrial operations.

LogicHub

LogicHub

LogicHub is built on the principle that every decision process for threat detection and response can and should be automated.

Drip7

Drip7

Drip7 is a micro-learning platform that is re-inventing the way companies train their employees and build lasting cultural change around the importance of cybersecurity.

US Marine Corps Forces Cyberspace Command (MARFORCYBER)

US Marine Corps Forces Cyberspace Command (MARFORCYBER)

US Marine Corps Forces Cyberspace Command (MARFORCYBER) conducts full spectrum military cyberspace operations in order to enable freedom of action in cyberspace and deny the same to the adversary.

Quad9 Foundation

Quad9 Foundation

Quad9 is a free security solution that uses DNS to protect your system against the most common cyber threats. It improves your system's performance, plus, it preserves and protects your privacy.

Secuna Software Technologies

Secuna Software Technologies

Secuna is the most trusted Cybersecurity Testing Platform in the Philippines. Our pool of vetted security researchers will find and ethically report security vulnerabilities in your product.

CyberTest

CyberTest

CyberTest offers cybersecurity consulting and penetration testing services that helps organizations and businesses securing their assets.

Klarytee

Klarytee

Protect your data wherever it goes. Klarytee is a SaaS platform that builds security into sensitive content to enable granular control in AI, public cloud and SaaS.

Trovent Security

Trovent Security

Trovent was founded with a clear goal: to support medium-sized companies in significantly increasing their IT security level.

Q-Bird

Q-Bird

Q*Bird's mission is to provide equipment for the current, and future European quantum internet.

SafeAeon

SafeAeon

SafeAeon is a leading Cybersecurity-as-a-Service provider, offering 24x7 premium Managed Security Services with AI-powered and Human-driven 24x7 SOC.