How to lead on cyber strategy in the post-pandemic world
Aare Reintam, Chief Operating Officer at CybExer Technologies, shares three tips for taking the lead on cyber strategy as we move back to something close to pre-Covid life.
Cybersecurity can be a real headache for CTO’s and, unfortunately, the pandemic if anything has made things worse. When Covid first struck, organisations and individuals responded swiftly with a wholesale transition to remote work. The use of cloud-based collaboration tools has soared and with it, many of the benefits of centralized IT control have evaporated. Privileges have been extended to non-technical workers leading to increased opportunities for errors that cybercriminals then exploit.
The upside of the democratisation of business apps during the pandemic is that we have all improved our digital dexterity. Employees of all ages and backgrounds have upgraded their kit and software for remote work, and, thanks to a heightened awareness that cybercrime is on the up, digital vigilance is now the mantra among most companies.
Vigilance alone, however, is not enough.
Cybersecurity is above all a human phenomenon. It starts with the CTO. A CTO is central to any business seeking to adopt a successful cybersecurity strategy. First, they must assemble a team of cyber-attack response units equipped with the necessary threat hunting tools and experience. Second, they must help every employee up their cybersecurity game. CTOs know only too well that it takes more than one or two courses for previously untrained employees to acquire enough skills to fend off hackers. Cyber attackers are constantly evolving their techniques so a company’s first responders must be its people. To do this effectively the cybersecurity team needs to perform regular drills to hone their skills while the remote workforce must be constantly alert to the possibility they may at any moment be tested.
Business in the post-COVID world is more dependent on technology than ever – and with the pandemic already making business survival precarious, cybersecurity has climbed up the pecking order. As the costs of cybercrime, in the form of revenue loss, reputational damage, and legal action, rise they can snowball until eventually, they bring down the business. With this in mind, here are my three tips for taking the lead on cyber strategy as we move back to something close to pre-Covid life.
1. Focus on every member of your team
It’s important to increase awareness, teaching everyone from school leavers to seniors to be suspicious of strange attachments and never to open them. The most sinister and disruptive cyber attacks very often use unsophisticated techniques. It only takes an employee to have one unguarded moment to let them in.
Lead from the top down, and give your workers the chance to create change from the bottom up. Aim to raise the bar for employees at all levels of the business – they are the first line of defence against cybersecurity tactics like phishing attacks and scams. Skilling up those employees outside of the IT department encourages them to share their experiences with the team and inspires them to contribute to your cyber defence posture. Beyond this, hold regular advanced training exercises for your IT team. Only a holistic approach that embraces everyone in the organization, with or without a background in IT, creates the defence-in-depth you need to withstand an increasingly sophisticated threat landscape.
2. Get the right tools to prepare your workforce
There are a great many cybersecurity tools to choose from. Some CISOs complain of too many. Most however are targeted at cybersecurity analysts and Security Operations Centre staff. Very few have the capacity to help everyone in the business. One that does is something called a cyber range. Cyber range technology enables any organization – whether they are a university, business, or government – to generate a realistic, capable and credible virtual environment that requires trainees to respond to cyber-attack simulations in real-time. Within the simulated network, users learn to cope under high levels of stress, locating and exploiting vulnerabilities on various network systems. This helps them develop the skills they need to identify, monitor and resist cyber-attacks.
Cyber ranges can be made to resemble your own IT network, providing a realistic training environment from task-driven Capture-The-Flag (CTFs) or live-fire drills to a combination of both (threat hunting). They are available as open-source software and can be deployed quickly through the cloud, allowing them to be rolled out to anywhere in the world quickly and easily.
3. Be brave
Cyber attacks are inevitable; it is a question of when not how.
When leading your company’s cyber strategy, make senior management aware of the financial losses at stake. Not just as a result of ransom demands but also as a consequence of regulatory penalties such as those issued by the ICO for GDPR breaches. Only once they understand the true extent of the company’s risk exposure, will you have the support you need to tackle the problem head-on.
READ MORE:
- Scaleup Spotlight: Climeworks is the key to fighting climate change
- How Wi-Fi6 will optimise hybrid working
- Which European countries have the best and worst cybersecurity?
- McAfee: How to make telehealth safer for a more convenient life online
The technological revolution has fundamentally changed the way we all live and work. When rapid change happens it’s easy for cybersecurity processes to be forgotten or missed out. Cybercriminals are alive to the opportunity and have been quick to respond with new exploits and attack techniques. Now it’s the turn of companies to respond by training their staff to be their first line of defence. There’s a lot of great cybersecurity technology out there capable of signalling the alarm. But those signals will always need a human interpreter which is why there can be no substitute for first-hand experience and know-how at every level.
For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!
Follow us on LinkedIn and Twitter
