Category: Technology

In the spirit of the recent Super Bowl, let me ask you this: Do you think the Patriots or Eagles would have made it it to the big game if coaches Bill Belichick or Doug Pederson didn’t focus on the basics first? How about legendary coach Vince Lombardi who after losing to Philadelphia in the 1961 Championship game (before there was a Super Bowl) started the next season holding up a football and saying “this is a football” then continued to work on the basics of blocking and tackling for the rest of training camp. His team won the Championship title six months later.

Whether you in pro sports or cybersecurity, getting back to basics is essential. However in modern times, organizations seem so focused on new technology or cutting costs and have forgotten about the cybersecurity basics.

When talking about cybersecurity basics we are talking about three things: People, Processes, and Technology.

We start with people because people are your first line of defense against a cybersecurity incident and as security professionals knows they are unfortunately your weakest link. They are your first line of defense because they can see anomalous behavior and activity, and they are your weakest link because they often don’t know what they are looking for.

Ransomware payouts of 5 billion dollar were made in 2017 with predictions for 11.5 billion by 2019. This attack is often successful because an innocent user clicks on the wrong link in an email or visits the wrong website.

This means that getting back to basics with people is all about good, consistent, and frequent security awareness training. Letting your workforce know that they are the front line defense against a cyber attack will peak their interest, they will want to learn more. Reminding them of their role and providing them with the knowledge they need to do something about it is the key in getting back to basics.

Make sure they know what to look for, what to do or not do on their computers, and how to report anything suspicious. Reward them for staying on top of security, give them some skin in the game (no pun intended.)

When you rely on that one annual security awareness computer course each year you are missing out on the basics. Your entire team needs regular training if they are going to be sharp on game day, which is everyday in the defense against the cyber attacker. And don’t forget that your employees who do have a job description that includes security need additional and ongoing training above and beyond what everyone else is getting.

We now move to processes because this is what people do daily for their jobs. It’s the process that gets data from point A to point B and the process can be manual or automated.

So what do processes have to do with cybersecurity? Processes are typically created by users who are trying to make their jobs easier (that’s fair) and have not given thought to security, which makes sense since it’s not what they are trained to do. However in creating those processes they don’t realize that they are creating security risks.

The solution is providing the business user with the knowledge that while they own their process they also have a responsibility for ensuring the processes is secure. That means providing a way for them determine easily if their new idea needs to be run by a security expert before implementing. Basically the players here (your users) need a coach (security expert) to run the play by before they run it on the field during the big game.

Last, but not least is technology and while many people think that technology should come first in protecting data it actually comes last. More on that in Security is Not an IT Problem.

This is about to get more technical and if you are a non-technical executive I implore you to read it and then talk with your technical advisors to determine how your team is doing on the technology basics.

From a technology perspective getting back to basics means ignoring all the new flashy technology on the market today. IT decision makers are inundated with fancy names, and terminology like cloud, artificial intelligence, threat modeling, next generation, ransomware, zero day, phishing, data loss prevention, and much more. This can divert their attention towards the new technology and away from the basics.

Patching is as basic as it comes for technology and something that has been around as long as there have been computers. However it is still not applied consistently within organizations and has been pointed to as the cause (there is never just one cause) for the Equifax breach. Only two months behind in applying the patch doesn’t seem like a big deal until it becomes one of the key reasons you lose 143 million customer records.

Back the football analogy when you know there is a patch available and you don’t apply it is like the coach and players knowing there is a hole in their defense, they know the quarterback can run right through it for the touchdown and yet they don’t make any change to fix the play.

There are many other basics when it comes to technology like password controls, user access controls, encryption, firewalls, and anti-malware software to name a few. None of these are new, they all have had technology to support them for a very long time and yet many organizations are not focusing on these basics. They allow users to have the same password for years, they don’t control the access levels that users have and often allow administrative access to non-administrative users, they don’t encrypt sensitive day, they have wide open firewalls, and they don’t install anti-malware consistently.

I warned you, that last section might have been Greek to you and that’s OK because you don’t have to know what it means, all you have to do is have someone in your organization or a trusted advisor you can consult with to ensure the basics are covered before you start purchasing all the new wizbang technology.

Start with the basics; people, processes, and technology, and build from there because you can have all the fancy technology in the world, but if you are not covering the basics you are still wide open to the offensive team making play after play. In other words you are allowing the hackers to come in and take whatever they want.

If you have questions about the basics email sharon@c-suiteresults.com. If you don’t have a security team and want more information on how Virtual CISO services work, which are designed to help small and medium size organizations maintain their security and compliance posture reach out so we can talk in more detail.

Does the word compliance make your skin crawl, send shivers down your spin, and make you want to run for the hills? It seems to do that to everyone I talk to, and therefore, I want to change the story and tell you why compliance, when viewed through a different filter can be the catalyst your organization needs in order improve its security posture.

There are so many compliance regulations, both government-mandated and industry-mandated, it is hard to find an organization that does not have at least one acronym they have to be complaint with. Whether it is HIPAA, PCI, FFIEC, FEDramp, DIACAP, NIST-171, GLBA, NYCRR 500, FISMA, SOX, GDPR, etc., there is a better-than-good chance you are on the hook for at least one of them. And why has this happened? It’s because when left to their own devices, organizations in just about every industry are not taking security seriously and data breaches continue to get bigger and bigger, affecting more people, costing millions and billions of dollars. Depending on the industry even putting lives in danger.

Some of these regulations can literally put you out of business if you fail to comply and even with that threat people call me saying they need to be compliant in the next three weeks. Instead of creating and maintaining an ongoing compliance program they say what do I need to do to be compliant and avoid the fine? Oh yeah, and it needs to be done in the next three weeks.” They are looking to meet the bare minimum standard, check a box and move on and that is when compliance feels dirty and doesn’t solve the problems it was setup to solve.

The reason compliance feels like a four letter word and makes most people cringe is the way that it is commonly handled.

Smaller organizations often don’t have the staff to properly secure their networks and data and have often outsourced everything technology related to a third party vendor. They are in “fire and forget” mode, meaning that as long as the systems are running and nothing strange happens, they figure everything is fine and they don’t discuss security or compliance with their vendor. The challenge with this model is that security is being left up to a third party and unless you are paying extra for a secure solution, most of the time the vendor is not providing much if any security solutions. It’s only when the organization finds themselves on the hook for compliance that they start asking their vendor the security questions they should have been asking from day one. As a result the compliance requirement helps drive their security going forward. If you are a small business who has outsourced your IT to a third party, I strongly recommend having the security conversation early in the relationship, preferably before hiring them.

Even large organizations who have a security team and a large IT department do not approach security in a systematic or strategic way and they also get complacent. The mentality from executive leadership seems to be that as long as everything is working and they don’t hear of any problems, then everything is okay and they don’t have to spend money on security. But is it okay? There are reports that indicate 50% of organizations will fall victim to some sort of breach and only half of those organizations will even realize it. As we often say in the security business, it’s not about if you are breached; it’s about when and whether you will even know about it or be able to respond. It is compliance for these organizations that is often how security teams and technology groups are able to get the budget they need for security.

Regardless of the size of your organization or the industry you are in, when compliance is viewed as an annual audit, which is how many people view it, and someone in the IT department or worse in the Finance department is told they are responsible for ensuring the compliance work is done on time in order to avoid any fines or penalties, it leaves a bad taste in everyone’s mouth. This type of attitude results in everyone spending the next two months working around the clock to validate compliance and do their day job.

Once you realize that compliance is never an annual audit or a one-and-done effort; rather it is an ongoing program that has to be built into daily operational procedures it can stop feeling like a fire you have to keep putting out. During the process of ongoing compliance you are improving the security and longevity of your organization and protecting in some cases the health and livelihood of your customers.

Of course post-breach remediation lights a fire under everyone’s ass to get their security up to par, and as such it’s as compelling a motivator as you can get, but it’s also the worst possible motivator to face and why compliance should be seen as a good thing rather than a bad word. Not only does compliance provide the necessary budget and attention you need for your organization, it provides a systematic approach that can make implementing security more manageable so that you don’t have to face the post-breach clean-up, lawsuits, brand damage, etc.

When the story changes and compliance is viewed as a business driver, something that leads to a better competitive advantage, and everyone’s responsibility, it does not have to be so hard or “dirty.” When you have the right resources, whether internal or external, to help you set it up correctly from the start, teach the organization what it means, why it’s important, and why their role matters, it become manageable.

If  you are in business to stay in business and grow, security matters, and you will want to embrace compliance as a driver. As a consultant in this arena I work with a lot of clients where I come out knowing that they have made a real difference in their security posture and their future growth.

If you have questions about compliance or want to discuss strategies for making it easier, email sharon@c-suiteresults.com. If you don’t have a security team and want more information on how Virtual CISO services work, which are designed to help small and medium size organizations maintain their security and compliance posture reach out so we can talk in more detail.

I was interviewed for a podcast recently for a new show that is all about the business of information/cyber security, and the hosts asked me what I thought was the number one thing that should change in the industry. My answer had nothing to do with more secure software, better security awareness training, better patching schedules, anti-virus, or bigger security budgets. It had to do with the role of the Chief Information Security Officer (CISO).

Since cybersecurity strategy is one of the hats I wear, this was an easy question to answer. Until the CISO has the same seat at the table with the CEO and the board just like the CIO and CFO do, security within an organization will never be a priority. As I mentioned in my article The Culture of Security, security culture, like all culture, lives or dies from the top down.

Most people I talk to outside the security industry have never heard of a CISO, but they can tell me what the CEO, CFO, COO, and CIO are. When I tell people that I am a virtual CISO, I often get blank stares or the question about what’s a CISO.  What this tells me is that security is still taking back stage in the landscape of business strategy and priority.

I talk to a lot of CISOs and hear their stories, more often than not they tell me they report to the CIO, and that rarely if ever do they get in front of the board. When the CISO does not actually sit at the table with the decision makers, whether that’s the CEO and CFO or the board and their message is filtered through another level or two before ever getting to the decision makers, the importance and context of their message gets lost. Moreover, if those decision makers have questions, there is no one at the table to answer them.

When the CISO reports to the CIO, which is the most common reporting structure there is a real issue that needs to be discussed. The CIO and CISO have different priorities and even conflicting priorities. The CIO is responsible for making data and assets available to support business functions. Funding is generally tied to performance of those assets in support of business needs. Conversely, the CISO is responsible for managing business risk, risk that extends to all responsibilities of business and not just technology. The CISO may also recommend a level of protection for data and technology in such a way that negatively impacts the performance of those assets, a metric that is very important to the CIO. Reporting to the CIO will mean security decisions align with the protection of information assets versus protection of the business and only to the degree that does not too badly impact the numbers the CIO is responsible for.

I’ve also seen where the CISO reports to the CIO who reports to the CFO, which has an even bigger impact on their contact with the board. Now the CISO is two layers removed from the top decision makers and strategists, and the person responsible for reporting the information is someone who does not have the background to properly communicate the message or answer important questions. The CFO is interested in budgets and return on investment, which is hard to see with security. The work of the security professional is often invisible and is very hard to prove ROI when the result of doing a good job, having the right people, and the right tools is no breach or no loss of data. It is very hard to tie the effect of no breach to the cause of a good security department.

Here are my recommendations for leaders who don’t want their brand on the front page of the paper because of a breach or security issue:

If you are the CEO or sit on the board of an organization and you believe that security is a priority, ensure your CISO reports to you or another independent executive that is looking at the organization as a whole. For example the Chief Operating Officer, Chief Risk Officer, or General Counsel could be good for reporting structure as long as the CISO has the opportunity to directly brief the board at least quarterly.

If you are the CIO and you have a CISO reporting to you and you believe your organization should take security more seriously, talk to your CEO about moving the CISO out of your reporting chain. Even if you can be unbiased, It’s the right thing to do for your organization.

If you are a CISO or aspiring CISO for your organization, and you report to anyone other than the COO, General Counsel, Chief Risk Officer, or CEO, I would consider having this conversation with the executive team as a whole. Not because you don’t trust your CIO or whomever you report to, but because security is a real current threat and they hired you to help create the strategy to stay secure. You can’t provide real time direction if you are not riding in the same car as everyone else.

If you are looking to take a job as a CISO for a new organization, when you negotiate terms for the position, ensure that you report to the CEO, COO, or General Council. If they say no, it’s a sign that they might not take security as seriously as you want them to, and you might not be happy working there for long.

If security was just a simple part of an IT organization, it would make sense for a security executive to report to the CIO, and they wouldn’t need the “chief” in their title. However since every part of the organization is reliant on security, and not just within IT, it is incredibly important for the CISO to sit outside of IT where they can have a view of and help the organization at large.

The intent is for the CISO to have an unbiased chain of command and access to brief the decision makers and an opportunity to answer their questions. If security is important to your organization this one change could be a real lasting impact that you are looking for.

If you have questions or want to discuss the challenges of the CISO, email sharon@c-suiteresults.com. If you don’t have a CISO, but want more information on how Virtual CISO services work, which are designed to help small and medium size organizations maintain their security posture reach out so we can talk in more detail.