February 07, 2017
Security breaches should be a top concern for all organizations as they can cause a lot of damage to the company and its customers. It’s an unfortunate, but realistic, expectation in today’s workplace, so companies should take the initiative to prepare for this type of situation.
Originally posted on Think IT.
It can often seem like every time you turn on the news a new data breach is in the headlines. And, while breaches are often unpredictable, there are actions organizations can take to assess vulnerabilities and prevent attacks.
At our most recent CIO meeting, senior IT leader Bill Bradford shared one of his experiences with a security breach involving an externally-hosted, sales and marketing site as a case study, along with his takeaways from the incident.
Strategy
Takeaway – Develop a strategy and prioritize risk. There is no one-size fits all strategy, but it is important to develop one. Does your organization have a security toolset that provides protection, detects vulnerabilities, and strengthens your systems? Ensure that your systems monitor and test properly to understand the full scope of your environment. And, with mobile applications, desktops, and other software, safeguard the security framework to protect customer/client data and internal systems.
Tremendous growth in an organization can put a lot of pressure on IT to maintain security; however, IT should not be the only department that is hands-on and knowledgeable about security. Breaches can occur in any department, so it is important for leaders from all departments to communicate new projects or plans regularly so that the organization can assess the risk involved.
Action Plan
Takeaway – Have a measurable risk action plan. Bill stressed the importance of educating your organization as a whole on security protocols as end users can pose the biggest risks. “CEO fraud” or business email compromise is a popular phishing scam that has resulted in millions of dollars of wire fraud theft. Check out these 6 Common Phishing Attacks and How to Protect Against Them shared on Tripwire.
Bill also shared some additional action plan ideas such as starting with the basics of reviewing your firewall, admin passwords, password complexity, and so on. You can also refresh and update items like encryption, email filtering, and consider a new endpoint solution.
Communication with the Board
Takeaway – Have an effective way to discuss risk with the Board. Don’t be surprised if your Board isn’t keen on hiring a CISO or spending those extra dollars for protection when risk may seem low. You can use the cybersecurity framework- NIST as a starting point. This may involve providing some education, but will ultimately help you develop your credibility with the Board and help you persuade them to invest in areas that may ultimately save your company money. Just remember to translate the risk into dollars.
How have you elevated security in your organization? Share your experiences in executing an incident plan.
Posted By: Jaclyn Roman