How secure is your company, really? Most security professionals can’t answer this fundamental question. In recent years, IT practices, systems and infrastructure have dramatically changed as new technology waves, beginning with virtualization, software as a service (SaaS), cloud and now Internet of Things (IoT), have swept across the enterprise.
While these advances have driven efficiencies across the board, they’ve increased attack points and vulnerabilities available to the “bad guys”. Today’s typical approach involving complex, manual processes cannot scale for the modern enterprise, due to a shortage of cybersecurity professionals and the shortage’s adverse business impact, which comes from too many onerous security controls placed on the end-user. The bottom line is that disconnected security is slowing down business operations.
As of 19 April this year, there have been over 269 data breaches exposing more than 11.27 million records according to the ITRC Breach database. Today’s security teams rely on a huge portfolio of security tools, which leaves organizations with more complexity – they simply don’t have the time, the money or the staff to effectively find and fix threats. This defensive posture is no longer acceptable.
The key to not ending up in national headlines or fined by an agency for a data breach is to truly understand how secure your enterprise is. If you don’t have the answer to this vital question, your security team is working blindly, which puts your company, its reputation and its customers at an unnecessarily increased risk. Here are the steps to determine how secure your company truly is:
Implement full visibility control over data, tools and service providers
Can you confidently say if your third party tools and service providers are secure? If not, they will weaken your security stance within your network and put your data and assets at risk. Full visibility and control over all data, tools and service providers enables your team to control and optimize everything going on in your network, while ensuring that no part of your security portfolio is impairing your security posture. Not only will this model improve your security view, it will also increase efficiency, IT security agility and optimize existing tools.
Conduct a thorough security rationalization project
With the vast range of disparate security tools available, it’s hard to keep track of which tools are essential. It’s imperative to regularly take inventory of your existing IT security portfolio. Analyze how each security tool and process in the portfolio is adding another level of security and make sure there’s no overlap.
Here are the four steps I recommend to conduct your security rationalization project:
- Define Your Goal and Work Backwards -While your end goal should be to know how secure your company is, take some time to clearly lay out what your desired overall cybersecurity posture looks like.
- Admit Your Shortcomings - While taking inventory of your existing security portfolio, take a close look at all your tools, processes, systems and team members. Be honest with yourself about what’s missing and/or redundant.
- Map Back to Your Desired Business Outcome -Take time to step back and map your results against your project’s business and security goals. This will help put your security rationalization project in perspective.
- Make It Right - Chances are that you will find something that is wrong, missing, or redundant so invest some time in making your security portfolio right. Once you’ve finalized your security rationalization project, integrate the security tools into the company’s IT security policies to ensure you’re receiving the full security benefits.
Find the right balance between automation and man power
Relying on manual processes using point solutions to determine your security’s state of affairs is a nightmare. However large and efficient your security team is, they simply cannot continuously scale to match hacker’s evolving tactics, and the needs of increasingly demanding security tools. We can see this as the numbers of cyberattacks continue to rapidly outgrowing the number of cybersecurity professionals.
Finding the right balance between automation and manpower often requires a cultural change so reassure your team that automation won’t take their jobs away. In fact, automation will replace the low-intensity, repetitive, defensive work so your team can play offense with high intensity tasks and be able to give accurate status updates regarding security.
How secure is your company? It really does sound like a simple question. Ultimately, it will determine if your security teams are properly focused on your company, its reputation and its assets correctly in the face of increasing threats and IT security complexity.
Implementing full visibility control over data, tools and service providers, conducting a thorough security rationalization project and finding the right balance between automation and man power will finally let you answer this crucial question and protect your organization and its assets.