Finding the right cyber security strategy

Securing an organisation is a daunting task. Christine Bejerasco at WithSecure describes how CISOs should go about finding the right strategy

 

It’s an especially challenging time in cyber security. Every day seems to bring fresh news of more breaches and vulnerabilities. Rapid digitisation and ongoing cloud migration mean IT environments have never been more complicated.  While security professionals must deal with all of this on a daily basis, it’s the CISO who is accountable for the overall security posture of the organisation.

 

Whether joining a new company or being promoted from within, it can be daunting for anyone just stepping into the role. With so many competing priorities, it isn’t easy to know where to start.

 

So how can CISOs keep their organisations secure without feeling overwhelmed?

 

Start with business outcomes, not threats

One of the most common mistakes in cyber security is becoming fixated on the myriad of potential threats. It’s a dangerous trap because it is impossible to keep up with everything. There were over 24,000 new Critical Vulnerability Exposures (CVEs) in 2022 alone and approximately 300,000 new malware strains. On top of that, the industry headlines are full of severe breaches and new attack tactics from high-level threat groups.

 

Further, not every potential security problem will need solving, or even be worth your attention if it isn’t directly relevant to your organisation.

 

Instead, the starting point for security should always be the outcomes the business would want to achieve. What parts of the organisation’s IT infrastructure are the most important to its operations? What assets will cause the most damage to the business if they are disabled or stolen?  

 

Starting from a solid set of business outcomes, the CISO can identify the most significant risks to the organisation. These risks should be mapped to specific business assets. For example, perhaps a particular piece of software, critical to a software developer’s CI/CD process, could be exploited in an attack. Or the personnel of a department, like HR or finance, are vulnerable to social engineering.

 

Securing these elements demands an accurate and reliable inventory of all business assets, so establishing this must be a priority, if it doesn’t exist yet.

 

Don’t do it alone

The CISO has ultimate responsibility for securing their organisation, but that doesn’t mean they have to carry the burden alone. Security should be a collaborative process that ideally involves stakeholders from across the organisation. Security heads should look to work closely with their board and seek to gather allies across the business. This will help them better understand how cyber security interacts with the business’s operations and objectives, as well as making it easier to put a positive face on security rather than being perceived as a negative, limiting force.

 

Forging these connections partly depends on the CISO’s ability to clearly communicate security issues in a way that non-technical people will understand.

 

Cyber security is a profoundly technical field, steeped in acronyms and phrases that are nigh-incomprehensible to the average person. Some high-profile trends, like ransomware and phishing, have become familiar due to exposure through news headlines, but other areas are much more obscure.

 

Conversations should always focus on the business outcomes and skip over the technical details whenever possible. By communicating security’s value as a catalyst for driving top-line growth and improving bottom-line results, it will help to shift perceptions that security is more than a cost centre.

 

It’s also important to remember that cyber is just one aspect of business risk, and risk is, in turn, just one of the boards’ many priorities. The board doesn’t need the fine technical details; they need to be confident that the CISO and security team are doing their jobs. 

 

No need to start from scratch

While every security strategy must be bespoke to an organisation’s unique infrastructure, processes, and risk profile, a wealth of knowledge and guidance is available to help.

 

Frameworks such as NIST will provide a solid foundation for building the security strategy. NIST, for example, sets out everything from identifying threats to recovering from incidents. Each area sets out the most critical capabilities needed for effective security.

 

An easy starting point is to lay this out in a giant spreadsheet, with everything you need in each area. For example, when improving security for your web server, under the identify column, it may list the ability to detect if something is trying to scan the server. If you have that capability, you can move on to the next recommendation until any gaps are filled.

 

Finally, it’s important to remember that not every problem needs to be solved by investing in a new security solution. In many cases, security can be sufficiently improved by first tightening up things like access policies. Another solution may be to retire or replace a vulnerable asset that is deemed unimportant and/or underused by the business. It’s often simple steps like this that can lead you on a path to better security.

 

Taking on responsibility for securing an organisation will never be an easy task, especially when the accountability stops with you. However, by taking the opportunity to collaborate with their colleagues and build on all the existing knowledge and guidance in the industry, CISOs can craft and maintain an effective security strategy without being overwhelmed.

 

---

 

Christine Bejerasco is CISO at WithSecure

 

Main image courtesy of iStockPhoto.com