The Bedrock of Security

Many organizations struggle with insecure access methods and unidentified processes. Integrating new, updated resources and technology can be an increasingly valuable commodity for any organization. But without building the foundation first, it could end up wasting an organization’s valuable time and money instead of advancing it.

For some applications, that level of expense may be justified. According to a study by IBM, the median cost of a data breach in 2019 was $3.9 million, or about $150 per lost record, with healthcare as the costliest industry. The company pointed out that it took an average of 279 days to contain a data breach after its discovery. And it noted that if a third-party partner was also breached, it could cost an extra $370,000. In other words, the financial and operational consequences of a malevolent hack can be huge, along with damage to the organization’s reputation.

Breaches are indeed expensive, and the good news is regulators are requiring greater security oversight. For example, The NY DFS Cybersecurity Regulation (23 NYCRR 500) is a new set of regulations from the NY Department of Financial Services (NY DFS) that places new cybersecurity requirements on financial institutions.

These regulations being put in place are a direct result of customer and consumer demand for tighter security. For example, one way in which the demand is being heard is with the recent California Consumer Privacy Act (CCPA), which is the first major U.S. privacy law to unfold. For consumers and customers to keep making transactions they need to first agree on security standards and adhere to any and all regulations that apply.

Transforming Business

Digital transformation, which is ongoing and touching every type of business, has elevated the importance of their information systems to unprecedented heights and brought new focus to IT. State and national governments have also been attuned to these risks, as well as, the opportunities that digital technology offers. The resulting worldwide surge of new privacy protection and cybersecurity laws has compounded the urgency to protect digital assets and to integrate security with other business functions.

The foundation of any IT security program is knowledge. Having this foundation of knowledge, identified processes, secure technology access methods and keeping it all up to date creates an efficient and effective IT security program.

For example, if an organization initiates an annual security awareness training program for its employees, it’s more likely to reduce the risk of a data breach. This means solid knowledge becomes the bedrock foundation, upon which other, more specific security platforms may later be integrated.

Having this integration is important. Emerging threats to different aspects of an organization’s IT operations have led many businesses to install an assortment of disjointed point solutions. Together, this increases the complexity of the security environment, making it difficult for any IT staff to respond quickly.

The Big Three Cybersecurity Essentials

A first key element involves discovering and managing the number and nature of assets attached to a network. Continuous security monitoring is vital because this count constantly fluctuates, and the organization’s attack surface is largely defined by those connected devices. Some are likely to belong to individual employees, Bring Your Own Device (BYOD), and are being used to transact company business. Making sure an organization knows what assets are connected to the network at any given times is essential in order to properly secure, monitor and manage all assets.

Another element of continuous security monitoring is managing the configuration of all assets on the network. This makes sure all assets are configured properly and monitors them for any drifting. Take, for example, a web browser update that is essential to protect against malware. How will an organization know if all assets are configured properly? The system in place will share what assets haven’t updated its web browser. Then the organization can take the next steps to make sure that asset is secure and configured correctly.

Third, and equally important, is the ability to detect changes in an organization’s configurations, new and existing assets and file integrity. If a hacker breaks into a system, one of their first moves is likely to cover their tracks. As a result, unauthorized changes to any asset or file can be a red flag, indicating a security incident or at least a system weakness that needs to be addressed.

While the cost of cybersecurity can reach extravagant levels, the cost of no cybersecurity is even greater. Investing in cloud-based continuous security monitoring software is imperative to constantly monitor areas of vulnerability, while reporting irregularities to the organization’s IT professionals. Using this essential information allows IT professionals to focus attention where the need is greatest.