Three Simple Steps To Effective Cybersecurity

The cybersecurity landscape can be difficult to navigate. From the outset, it can seem like a crowded place, with countless cybersecurity providers offering what appear to be incredibly similar solutions. There’s also the question of outsourcing vs in-house cybersecurity and the ramifications that accompany each choice.

Even once these details have been ironed out, there are a multitude of different factors which must feed into an organisation’s cybersecurity strategy.   

As each organisation is unique in its IT infrastructure and tech stack, it’s understandable that each one would need to take a nuanced approach to cybersecurity. Despite this, there are three key steps that I’d recommend all organisations follow if they are to ensure effective cybersecurity protection.  

1.    Shift left – Invest In DevSecOps 
Security teams often don’t have enough control over the app development life cycle. Companies are buying capabilities from hyper-scalers and cobbling together apps with open source, but they’re not thinking about the seams between widgets and frames. These organisations need a set of policies that are established and implemented as code. 

By leveraging DevSecOps, organisations can ensure that security is incorporated far earlier into the software lifecycle development process and is also a shared responsibility throughout the entire IT stack. Security should be considered a priority from day one, by everyone from the C-Suite down to the developers writing the code. 

In fact, developers are key to maintaining security throughout the software delivery lifecycle. Their approach to security must be consistent, meaning that it should be built into every line of code that’s written.

Providing developers with the relevant training, as well as open lines of communication with the security team are the key ingredients needed to enable this. 

2.    Shift right – Prepare To Recover
Understand what your business-critical systems are and assume you will get hacked. How long can you afford to be down? And where will you pull back good, known data and system configuration? Think within the context of where your data and services are and how to bring them back up again in the order of priority that they need to be recovered. 

Though investment in prevention measures is still essential, it’s naïve to imagine this will be 100% effective. No cybersecurity solution is perfect as there will always be vulnerabilities. The conversation has moved past “how do we prevent an attack?” to “how do we survive?”. As a result, it would be foolish not to also implement a strong recovery process. 

3.    Level up – Simplify In The Middle
It’s not uncommon that organisations inadvertently acquire a convoluted or mismatched set of cybersecurity solutions. This is easily done as new tech may have been hastily adopted in a reactive manner following a breach. Alternatively, security technology is often sold by vendors as part of technology packages that include a number of other capabilities. Therefore, it may not have been directly selected and purchased by the CISO. As a result, they may inherit a disconnected security stack made up of different technologies that only target single or narrow use cases.

An organisation is unlikely to be receiving the very best cybersecurity protection if its stack is built upon a non-complementary set of tools and services. 

Building a more resilient IT infrastructure is key to securing the overall organisation. It starts with a focus on the integrating of (often a plethora of different) tools and technologies and the overall outcome, rather than fixing issues on a case-by-case basis. The easiest way to integrate different technologies in a tech stack is to simplify it. CISOs need the opportunities to conduct a thorough ‘spring clean’ of their tech stack closet. Throughout the process, they must identify the key capabilities of the organisation – everything beyond this can go. 

Maintaining a healthy cybersecurity posture is not an easy task as cyber attackers are consistently becoming more sophisticated and elaborate in their methods. However, it’s by no means impossible. By following the principles outlined above, cybersecurity professionals can support a vigilant and agile approach at all times. 

Allen Downs is Vice President, Security and Resiliency Services at Kyndryl

You Might Also Read: 

How To Optimize The DevSecOps Pipeline:

 

« The NSA Hacked Huawei Long Ago
Containers Are Temporary, But Container Data Is Not »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Aurec

Aurec

Aurec provides specialist recruitment and contracting services including ICT professionals.

Maureen Data Systems

Maureen Data Systems

Maureen Data Systems (MDS) services cover Data Centres, Cloud Computing, Cyber Security, Mobility, Virtualisation, Managed Services.

European Internet Forum (EIF)

European Internet Forum (EIF)

EIF’s mission is to help provide European political leadership for the political, economic and social challenges of the worldwide digital transformation.

Threatpost

Threatpost

Threatpost, is an independent news site which is a leading source of information about IT and business security.

CERT-SE

CERT-SE

CERT-SE is the national and governmental Computer Security Incident Response Team of Sweden.

IoT Security Foundation (IoTSF)

IoT Security Foundation (IoTSF)

IoTSF is a collaborative, non-profit organisation with a mission to raise the quality and drive pervasive security in the Internet of Things.

Axis Capital

Axis Capital

AXIS Insurance’s Professional Lines Division is a leading underwriter of technology/cyber coverage and other specialty products around the globe.

Cobalt Strike

Cobalt Strike

Cobalt Strike is penetration testing software designed to execute targeted attacks.

SysTools

SysTools

SysTools provides a range of services including data recovery, digital forensics, and cloud backup solutions.

Cyberens

Cyberens

Cyberens provide cybersecurity consulting services in IT sectors relating to defense and space, banking, industrial control systems and IoT.

C2A Security

C2A Security

C2A Security offers a comprehensive suite of cyber security solutions for the automotive industry, providing in-vehicle end-to-end protection.

ArcusTeam

ArcusTeam

ArcusTeam is at the forefront of the firmware and applications security industry, with a mission to increase the level of security on all IoT devices and applications.

Kratikal

Kratikal

Kratikal provides a complete suite of manual and automated security testing services.

Thoma Bravo

Thoma Bravo

Thoma Bravo is a leading private equity firm with a 40+ year history and a focus on investing in software and technology companies.

Xscale Accelerator

Xscale Accelerator

Xscale's vision is to create world-class startups out of India by transforming sales and providing access to global markets.

Solvere One

Solvere One

Solvere One is a managed service provider (MSP) focused on corporate consulting and partnership.