"New Year, new threats" could easily be the mastermind of many security experts this year. The arrival of a mandatory data breach notice in 2019 highlights how widespread cyber security vulnerabilities have spread and spread to Australian organizations of all stripes. But since IT leaders and cyber teams understand everything from AI to the blockchain as the silver bullet for their security woes, I would say that the best defences are actually a lot easier than they might think.
Assumption 1: You are protected by your password
If we have learned anything from the crime of identity theft, mass social engineering, and the success of retrospect over the past decade, that passwords do not provide strong security for cybercriminals. In contrast, password policies often give organizations less security than they might otherwise have. Password change leads to unhealthy user behavior, ranging from rotating password reuse to password failure in areas under protected areas. So, create even ineligible password attributes (at least one character, special character, emoji, etc.). But to this day, we insist on these ancient strategies as the basis for how we protect business plans and data.
Ironically, we already have the necessary programs to make passwords good (or at least not so bad) again. Many banks have already used two-factor authentication to protect their customers' finances. Many types of IT monitors have been using password managers for years, if not decades. The introduction of these two processes alone could greatly increase the security of almost every organization out there — and make advanced password systems, such as confusion and duplication, more vulnerable to hackers than they are today.
Assumption 2: Employees need more cybersecurity training
Don’t get me wrong, training plays a very important role in good cybersecurity. But in recent years, I have seen a tendency among many organizations to rely on training as a means of saving their cyber security efforts, rather than addressing the root causes of organizational vulnerability. You can’t rely on your employees to be fully trained to handle every vector of attacks that may escalate on them — just as you wouldn’t expect your highly trained employees to stay in your organization forever. There are online cyber security courses available for professionals to learn and pursue it as a career. These professional cyber security courses from providers like NIIT help in catering to the demand of professionals who are responsible to guide an organisation for better online security.
IT leaders will do well to redefine their priorities from training level to track. Basic cyber security practices for email security, data protection, and privacy control should be part of the new staffing process - but should not go as far as skipping new employees. Frequent but concise reviews of the latest threats and trends can keep awareness of all employees as time goes on.
IT leaders may even consider working with their communications partners to make cyber security a part of normal internal conversations. And at the same time, cyber security teams need to develop appropriate security measures, from monitoring networks to filtering suspicious content, so they don't just rely on co-workers - you know, they also have tasks to do - to protect and defend. It may be true that employees are at the forefront of cyber defence. but they are certainly not expected to be just in line.
Assumption 3: We are doing sufficient to stay secure
Despite it reaching headline status on almost every IT leader’s agenda, cybersecurity still suffers from a perception problem—namely, that organizations think they’ve got it. I’m a long-time proponent of “assumed compromise” when it comes to cybersecurity: working on the belief that you’ve already been breached and will be breached again. We need to correct the notion that an organization can ever be fully secure, and assuming compromise does away with the complacency and hubris which have plagued cybersecurity policymaking and strategy for years.
On a practical level, this means taking contingency measures seriously: not only adopting but also enforcing basic processes like the 3-2-1 backup rule as insurance in the case of catastrophic data loss.
The conclusion
In an organization, to achieve effective Cyber Security, individuals, processes, computers, networks, and organizational technologies, large or small, must have the same responsibility. If all the components complement each other, it is highly possible to withstand a severe cyber threat and attack.
