What do you do if your cybersecurity measures are falling behind in the evolving technological landscape?

Identifying your threat vectors and continually reevaluating them should be a critical piece to your security elevation strategy. I’ve found hiring a company for an Internal audit, for ISO let’s say can show your gaps pretty easily. Yes, it’s work, but it can really be valuable and it’s also prep work for obtaining that certification.

Es necesario que las áreas responsables de seguridad de la información tengan conocimiento sobre los riesgos y controles que hay entorno a sus activos a proteger; además de que estándares, guías y normas son escenciales y aplican a las actividades de la organización. Porque a pesar de que pueda obtenerse el servicio de una consultoría, la Compañía puede anticiparse a detectar y evaluar riesgos previamente para actuar de manera oportuna. Además permitirá ver un panorama detallado porque conoce su proceso, sus debilidades, sus fortalezas y oportunidades de mejora.

Policy writing is a skill in itself, and something that you may want to consider getting outside help with. Within the ITOM world, everybody should be well aware of the risks and results of a weak cybersecurity stance. So, when it comes time to write policies and procedures, as well as training on them, we sometimes tend to approach it from thinking that some things are obvious. To users these things may not be obvious, or why they matter. One organization I joined had used their global address list to also store employees personal contact information and home addresses. They felt it was fine that other employees could, in an emergency, access that information if needed. They needed to learn the basics of why that was a bad idea.

With the rate at which different cyber security threats are advancing, to remain with old/outdated systems would be akin to bringing a knife to a gun fight. So, if you find that your cybersecurity measures are falling behind in the evolving technological landscape, it's time to invest in NGFWs (Next-Generation Firewalls), SWGs (Secure Web Gateways), and VPNs (Virtual Private Networks), that will strengthen your network security. Others are advanced thread protection technologies (IDS and IPS), etc.

"De la misma manera que la tecnología avanza para ayudarnos, también puede utilizarse para hacer daño". Es innegable que todo cambio en la tecnología trae consigo nuevas oportunidades para sufrir ataques y si es en el entorno OT, que el personal pueda salir dañado. Así que actualizar el hardware, gestionar las vulnerabilidades, parchar software, implementar políticas de uso de nueva tecnología y demás, es un pilar necesario de la seguridad de una Compañía.

It does not matter how good your tech is, what solutions you implement, or how rigorous your policies and procedures are. So long as there is somebody on the inside capable of being tricked into allowing threat actors to bypass them all then they are for naught. One of the biggest gaps I often see in this training process however is bringing it back to why it matters to them, their role in security, and how it is layered. Far too often I have asked people why they went to questionable sites, or followed links in emails, and their general reply was “I thought we had software to protect us”. They forget that these tools are partners to their own efforts, not parents watching over them.

Training is paramount, especially when it comes to cyber security and its constantly evolving landscape. The cyber security stance of any organization, as in the chain analogy, is only as strong as its weakest link. Invest in cyber security awareness training across your organization with the backing of senior management. And make cyber security awareness part of the culture of your company.

Recordar que somos seres que piensan y sienten es escencial. Leí una vez como en un hospital intentaban saltarse el modo bloqueo de una consola móvil colocando una taza frente delsensor que detectaba presencia humana, con el fin de evitar esa molesta acción de desbloquear la consola a cada momento. La implementación de seguridad no debe de obstaculizar con el trabajo eficiente de las personas, si no como seres humanos verán la manera de evadirlos. Todo debe surgir en un punto medio entre la seguridad y la usabilidad.

Your response plan must be multi-pronged, and your first goal should not be to resolve the problem but to fully identify what you are dealing with. We have all heard stories of companies that were the victim of a Ransomware attack, and restored files from the backups to resolve the problem, only to find out later they were also infected and end up in the same, if not worse, situation as they were losing the confidence of the staff and customers. So, your very first responsibility is to understand what is happening, where it is happening, and try to isolate and break it down to get a better understanding. You can try to segment off uninfected areas and hopefully restore parts of the organization.

As I stated above, I think that going for security certifications, can show you really easilyw where your gaps are and how you need to elevate. Additionally, they can help you start with what is required and allow you to iteratively improve each year sometimes what is required is not as daunting as it may seem, and I really encourage companies who think they would never be able to get the proper certifications because there’s security is poor to really look at what is required and how the iterative process you’re over here creates more achievable, elevation

As I stated above, I think that going for security certifications, can show you where your gaps are and how you need to elevate. It also forces the risk evaluation processes. While prepping for a cert, or at least going through the exercise, like with an internal audit, is a lot of work, it holistically allows you to evaluate your posture. Additionally, this can help you prioritize by what is required and allow you to iteratively improve each year. Sometimes what is required is not as daunting as it may seem. I encourage companies who think they would not be able to get a proper certification, because their security has gaps, to really look at what is required and how the structure creates more achievable, elevation goals long term.