Cyber Security Strategies Need To Evolve Alongside The Enterprise

It wasn’t until recently that the C-suite could have long discussions surrounding technology solutions and strategies without having to give security a second thought. Today, however, that’s almost unfathomable. 

Where the pandemic induced a transition to hybrid working out of necessity, operational changes were initially additive. The mindset was one of temporary solutions to temporary challenges - employees needed frictionless computing, so companies would introduce applications and infrastructure in the interim that would ensure productivity could continue in a remote setting.  

Now that we have a clearer view of where and how people will work, this approach has had to change. For hybrid and remote models to be secure and sustainable, new structures need to be developed that work for everybody – wherever they are and however they’re working – while also keeping data safe and secure. 

No longer is security a case of protecting one specific network for the company; the hard-shell perimeter of the office.

As well as threat actors continually evolving their methods to circumvent existing security frameworks, organisations now need to protect substantial digital asset bases and business-critical applications extending across increasingly connected global networks.  

Security Is A Growing Consideration 

This changing state of play has allowed security to knock loudly on the front doors of the business decision makers.  It is now a key strategic consideration. Indeed, there is little point in a company implementing a solution designed to enhance productivity if that very same solution undermines security and leaves firms exposed to suffering financially crippling breaches – indeed, according to IBM, the average cost of a breach in 2022 was $4.24 million.  

Security teams now need to adapt and align their approaches to ensure they are considering the wider needs to the business and their colleagues. Much of this is about communicating more openly and actively, and in understandable ways, to ensure everyone is up to speed on key cyber trends.  

Protecting the enterprise needs to be the responsibility of everybody. Organisations today hold lots of information in a variety of formats, stored across different departments using different solutions. Not only is this information vital to an enterprise (intellectual property) and its customers (personal and financial data), but it often may be data belonging to third parties (customers, business partners, suppliers, etc). 

To mitigate this risk, it is critical that a cybersecurity workplace culture is created – where security becomes a primary consideration all aspects of operations; part and parcel of how work is done.  

Building A Better Understanding Works Both Ways 

CISOs need to be on the ground as much as they are in the boardroom, gaining a comprehensive understanding of potential risks that hybrid working could pose. For example, those working from home may be leveraging networks with outdated and exploitable factory settings, devices may not be updated in a timely fashion, preventing the patching of vulnerabilities that attackers can utilise. And shadow IT is also a problem, where staff members may be using unmanaged, unprotected devices to access sensitive data on corporate networks. 

Security should be easy to embrace - if it is not, it will be ignored or even worse circumvented. If security requires end users to jump through additional layers of red tape or suffer process changes or loss of performance in order to do their job, they will find ways to operate that work for them that remove those barriers such as using personal devices and creating potentially invisible backdoors into the organization.  

Understanding Behaviours To Reduce Risk Factors   

Critically, CISOs must recognise that an understanding of the social, economic and mental health impacts of workers is required in a hybrid environment to reduce social engineering risk factors. By identifying and targeting common psychological triggers and gaining the trust of the potential target, attackers are finding greater success in overcoming individuals’ natural defensive instincts. 

Ensuring employees are aware that these are the sorts of tactics that can be employed is vital. Showing highly advanced spear phishing examples can be a way of instilling a more conscious mindset. 

Critically, as the lines begin to break down between security and the wider business, the opportunities need to maximise in this way. By adapting security strategies to meet the needs of users and better address growing threats simultaneously, firms can ensure all employees become patrons of security - not the individuals undermining it.  

Mark Guntrip is Senior Director of Cybersecurity Strategy at Menlo Security

You Might Also Read:

Under Pressure - Can CISOs Avoid Burnout?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cybersecurity & The New Space Race
Digital Platform Regulation - Impossible? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: Harnessing the power of Security Information and Event Management (SIEM)

ON-DEMAND WEBINAR: Harnessing the power of Security Information and Event Management (SIEM)

Join our experts as they give the insights you need to power your Security Information and Event Management (SIEM).

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

InformationWeek

InformationWeek

InformationWeek is the world's most trusted online community for business technology professionals like you.

Allen & Overy

Allen & Overy

Allen & Overy is an international law firm. Practice areas include Cybersecurity and Data Protection.

Cyber 360

Cyber 360

Cyber 360 is a Cybersecurity contract and fulltime placement firm dedicated to identifying and hiring Cybersecurity professionals.

Cryptomathic

Cryptomathic

Cryptomathic is an expert on commercial crypto - we develop, deliver and support the most secure and efficient off-the-shelf and customised solutions.

Verimatrix

Verimatrix

Verimatrix is a global provider of innovative cybersecurity solutions that protect content, devices, software and applications.

Korea Internet & Security Agency (KISA)

Korea Internet & Security Agency (KISA)

KISA is committed to improving the competitiveness, reliability and security of Internet information and knowledge in Korea.

Data Security Council of India (DSCI)

Data Security Council of India (DSCI)

DSCI is a premier industry body on cyber security and data protection in India, committed to making the cyberspace safe, secure and trusted.

XCure Solutions

XCure Solutions

XCure Solutions are a Finnish company specializing in data security, data protection and data recovery.

Recorded Future

Recorded Future

Recorded Future arms security teams with threat intelligence powered by patented machine learning to lower risk.

CybExer Technologies

CybExer Technologies

CybExer provide an on-premise, easily deployable solution for complex technical cyber security exercises based on experience in military grade ranges.

ReconaSense

ReconaSense

ReconaSense helps protect people, assets, buildings and cities with its next-gen access control and converged physical security intelligence platform.

CyPhyCon

CyPhyCon

CyPhyCon is an annual event exploring threats and solutions to cyber attacks on cyber-physical systems such as industrial control systems, Internet of Things and Industrial Internet of Things.

Blue Lance

Blue Lance

Blue Lance is a global provider of cybersecurity governance solutions. Our software solutions automatically collect and store the information necessary for investigations, audit and compliance.

SecureTech360

SecureTech360

SecureTech360 is a cybersecurity and IT consulting firm whose principals have extensive experience in Cybersecurity and Information Technology.

Gen Digital

Gen Digital

At Gen™, our mission is to create technology solutions for people to take full advantage of the digital world, safely, privately, and confidently – so together, we can build a better tomorrow.

Unisys

Unisys

Unisys is a global information technology company providing industry-focused solutions integrated with leading-edge security to clients in the government, financial services and commercial markets.