In the first and second parts of this blog series, we shared the importance of focusing on the basics in cybersecurity and shared some tips for how to get started. Let’s wrap up by sharing some additional considerations you should address as you get started on your path to a more secure enterprise.
Imagine a customer who is short on the basics, but does have a “named product,” like an SIEM solution, a logging analytics product, or behavioral analytics looking at the north-south and east-west traffic. They may also have full compliance testing for something like PCI or HIPAA (note that compliance doesn't mean secure).
What good is the SIEM if "cybersecurity 101" hasn't been addressed? History shows properly set-up and monitored log collection solutions are great at discovering incidents, but not so good at preventing or discovering breaches. Again, consider the humans. Not many tools offer full automation that bypasses the need for trained staff to be watching, and those that do often have complex rule bases that still require lots of human intervention.
At ConvergeOne, do we want customers to consider technology in their cybersecurity strategy? Sure, there are some fantastic tools out there—but hold on. First, there are some additional basics to consider:
Those who have been in this game for the last several years know that the Pareto principle applies to cybersecurity: 80% of the effects come from 20% of the causes. Therefore, focus resources on that 20% by automating routine or repetitive tasks, and applying due care on those high and critical-risk areas, as determined by your risk assessment methods.
If your cybersecurity consultant is skipping past the basics, be concerned. Make sure they speak fluently about all pillars: people, process, policy, and technology. If every word from their mouth is a three- or four-letter acronym, be wary. Make sure you understand what they are saying. At ConvergeOne, we make simplicity a priority. If we cannot talk about cybersecurity in plain terms that any person can understand, we have no business speaking to you.
Finally, this sounds counterintuitive, but there are better ways to vet a partner than asking for cybersecurity references. No one ever gives out bad ones. Your consultant should have credibility with other services it offers, the conversations it is having, and the vendors it partners with. Doing a half-day workshop, a short assessment, or on a small introductory project is always a good way to determine if your potential partner is a good match for you.
Stay safe out there!
Tuesday, April 16th at 2:00 p.m. ET
Presented by:
Tim Femister, Senior Director, Cybersecurity + Multicloud
Joe Vigorito, Director, Information Security Consulting
The statistics are staggering: spear phishing accounts for 95% of enterprise network attacks, according to the SANS Institute. Since attackers can craft messages to your employees posing as a reputable contact, technology can only do so much. To effectively prevent your organization from falling victim to cyber attacks, it’s essential that your employees develop strong cyber instincts.
In this ConvergeOne webinar, Tim Femister and Joe Vigorito will outline 10 steps to creating a cyber aware culture within any organization. Attend the webinar to take the first step toward building a culture capable of effectively defending against modern threats.