Who Is The Cybersecurity Guy In Your Organisation?

Too often, IT teams, if they address it at all, take a conventional approach to cybersecurity: lock all the doors, build a great firewall, restrict access, and eliminate any intruders. In today’s world, this is no longer sufficient or appropriate. Over the last few years, approaches to cyber-defense have, out of necessity, changed.

However, a few myths still permeate the debate. Most notably the ideas that 
1. Any problem can be solved by throwing a sufficient amount of money at it. 
2. That isolating yourself and securing only your own networks still in some way provides you with a competitive advantage. These myths in particular reflect poorly on companies’ ability to understand the future of the threat landscape.

Interestingly, the lack of clarity on the mandates and responsibilities for security within an organization rarely rank highly during company surveys of the primary barriers to ensuring an effective information security strategy is implemented.  Instead, external factors such as the increased sophistication of threats and emerging technologies are seen as the greatest challenges.

In line with this trend to underestimate the need for clear guidance on who should do what within an organization, various surveys often find that executives overestimate their companies’ ability to deal with cyber-attacks. In a recent survey, company employees showed extraordinary public confidence in their CEOs’ and directors’ security strategies. Despite industry research showing that it typically takes an average of 200 days to discover an attack on a network, 55% of the aforementioned respondents believed they could detect a breach within a matter of days; 25% answered a matter of hours.

Certainly, the threat landscape has changed, and we are ever more confident in the fact that new kit and gadgets can provide us with real-time snapshots of the activity on our networks. Cybersecurity software has also got clever: programs will learn patterns to stay ahead – intelligent locks if you like.

However, when dealing with an organization, be it large or small, cybersecurity has to start somewhere: with your employees. Account takeover remains the easiest way to enter a network. No need to force your way in through a complex web of security traps thought up by some savvy IT professional. Simply guess (rather intelligently in some cases through targeted open-source research) someone’s password and pivot your way through the network till you find what you’re looking for. If you’re lucky, an insider, preferably with administrator privileges, will even help you out whether they know it or not.

Training and direction remain some of the more essential components of a company’s security plan. Not only do we, in the United Kingdom, suffer from a shortage of skills within the cybersecurity industry itself, we also suffer from a lack of awareness of how to approach it on a day-to-day basis.
This is true at all levels of an organization. The board of directors is tasked with the responsibility of overseeing risk management – including cyber-risks – for shareholders, and yet many boards do not have any person or group on the board that possesses cybersecurity skills and is capable of functioning in that capacity. According to a 2014 board survey, 29% of corporate boards are not briefed on cybersecurity at all, while 30% are briefed once a year. The same survey found that 60% of companies do not have a Chief Cybersecurity or Chief Information Officer, and 61% of those companies allow cybersecurity duties to fall to the Chief Financial Officer.

We’ve established that employees need to have a basic understanding of their footprint on the network: which passwords they use, what files they should open or not, what information should be reported, and how to report that information. As a general rule, however, cybersecurity is not just a problem for a company’s IT department. As an organization-wide issue, companies must recognize that (1) not all data can be protected to a gold standard, (2) data that matters should be heavily protected and sufficiently isolated from a network’s weak points, and (3) not everyone is best placed to determine what data is important.

Overall, the board of directors and company Officers need to be supported in their risk management duties by competent security professionals who not only have a technical awareness of the issues at hand but, are also aware of the daily business practicalities that this entails.

Cybersecurity is everyone’s responsibility: the board must provide an informed overarching strategy to protect shareholders’ interest; the Officers must be kept up to date with latest trends and developments to keep both their IT staff and their other employees informed; and employees need to be made aware of the risk they could pose to their company’s network. Prioritizing the importance of data, based on its financial value and/or reputational attributes, remains a key consideration when handling both proprietary or third-party data.
Infosecurity: http://bit.ly/1RBQQC8

 

« Four Startup Companies That Are Harnessing AI In The Invisible Cyberwar
How The CIA Is Making Sense Of Big Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Octopus Cybercrime Community

Octopus Cybercrime Community

The Octopus Community is a platform for information sharing and cooperation on cybercrime and electronic evidence.

AcceptLocal

AcceptLocal

AcceptLocal is a payments industry consultancy with expertise in payment processing, payment security, anti-money laundering and fraud prevention.

Galois

Galois

Galois specializes in the research and development of new technologies that solve the most difficult problems in computer science.

SIS Certifications (SIS CERT)

SIS Certifications (SIS CERT)

SIS Certifications is an ISO certification body serving more than 10,000 clients in over 15 countries worldwide.

Improsec

Improsec

Improsec is a fully independent Cyber Security advisory company - we provide knowledge, experience and both strategic and deep technical expertise to our clients.

Huntress Labs

Huntress Labs

Huntress provides managed threat detection and response services to uncover and address malicious footholds that slip past your preventive defenses.

Eureka Technology Partners

Eureka Technology Partners

Eureka Technology Partners are committed to helping you focus on your business by taking care of your IT infrastructure and data security needs.

Guidehouse

Guidehouse

Guidehouse is a leading global provider of consulting services to the public and commercial markets with broad capabilities in management, technology, and risk consulting.

HarfangLab

HarfangLab

HarfangLab develops a hunting software to boost detection and neutralization of cyberattacks against companies endpoints.

Dawgen Global

Dawgen Global

Dawgen Global is an integrated multidisciplinary professional service firm in the Caribbean Region providing a range of services including Risk Management and Information Systems Assurance.

Think|Stack

Think|Stack

Think|Stack is a managed IT services company specializing in cloud and cybersecurity with human-centered design.

ThreatLocker

ThreatLocker

The ThreatLocker Platform provides a Zero Trust security solution that offers a unified approach to protecting users, devices, and networks against the exploitation of zero day vulnerabilities.

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

Commonwealth Scientific & Industrial Research Organisation (CSIRO)

CSIRO is Australia's national science agency. We solve the greatest challenges through innovative science and technology.

BitLyft

BitLyft

BitLyft is a managed detection and response provider that is dedicated to delivering unparalleled protection from cyber attacks for organizations of all sizes.

Cybervergent

Cybervergent

Cybervergent (formerly Infoprive) are a leading cybersecurity technology company in Africa. We provide cybersecurity guidance and solutions that help protect your business.

Emantra

Emantra

Emantra specialises in the enablement of Secure Cloud services through it’s comprehensive Sovereign Cloud Hosting, Secure Access Service Edge, and managed services.