Understanding where your biggest risks are, and how cybercriminals take advantage of those risks help CISOs to build a better strategy to defend against, detect, and address threats.
The role of a CISO today is one that involves being pulled in many directions. Every day involves a new attack vector, compliance mandate, security policy, or potential breach, with the CISO tasked with somehow providing a vision and execution that will future-proof the organization’s security.
Jan van Vliet, VP and GM of EMEA Digital Guardian recently discussed some key concerns for CISOs that, while simple in concept, should be addressed because of their ability to have a significant effect on organizational security. Some of the concerns included:
- Think like a cybercriminal – your security strategy should be based on the very methods hackers, scammers, phishers, etc. use to gain entrance to your endpoints, network and data. Microsoft has 288 pages of security recommendations you likely haven’t read. But guess you probably has? The cybercriminal. They’re studying your tactics. It’s time you study theirs.
- Focus more on mobile – we’ve discussed the rise in attacks on mobile here before. It’s an attack vector that has the user the most susceptible to being conned on a device that provides the least functionality to discern if web pages, emails, and attachments are malicious in nature or not.
- Extend security to your vendors – there’s a lot of discussion around supply chain security. But even those organizations without such a complex ecosystem need to be concerned about contractors and suppliers that have any kind of access to your data or network. Establishing security requirements of your vendors can make the difference between a vendor being a security asset or liability. Vendors are responsible for about half of all data breaches.
- Emphasize user training – Many of the issues expressed or implied above can be mitigated in part or whole by educating the user via Security Awareness Training to become a part of the organization’s cyber defenses. With users acting as another layer in the security strategy, a security culture begins to emerge that impacts interaction with every type of device throughout the organization’s entire ecosystem.
Whether you’re a CISO or simply someone concerned about information security, taking even these simple steps above can have a material impact on the quality and efficacy of your security strategy.
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
