It’s that time of year when, as the song goes, it’s beginning to look a lot like Christmas. Unfortunately, cybercriminals stop for no man – not even Father Christmas. So, arguably over the holiday period when many of us will have our attention focused on other things, it’s even more important to ensure that your organisation’s security posture is as robust as it can be.
A variety of cybersecurity and technology professionals have joined to share what they believe should be top of every CISO’s Christmas list to ensure tip top security – from budget and bandwidth to insight and education.
Go deeper with GlobalData
The CISO’s ultimate Christmas wishlist
Insight into the people and devices on the network
For Santa Claus, simply checking a list to find out who’s naughty and who’s nice may be easy enough. For security teams, the reality is very different. The insider threat will be on many CISOs’ minds over the Christmas period. Whether it’s a malicious insider or the result of stolen credentials, a threat inside your network is extremely difficult to detect.
Insight will be at the top of every CISOs’ Christmas list this year. Insight into the people and devices on the network, tied to the context of their role, workday and normal behaviours. Only then can you can spot the anomalies, identify suspicious behaviour and quickly find out who’s naughty and who’s nice. For many CISOs, that would be a Christmas miracle because today they only have coal.
Stephen Moore, chief security strategist at Exabeam
Exposure audits and employee training
As a CISO, the charitable spirit of the holidays opens the door to reconnect with your board ahead of the new year. Here are a few key ‘gifts’ you can ask for this year to improve your organisation’s security posture:
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“Service Exposure Audit – Most organisations don’t have a full inventory of their exposed services, and many don’t have any inventory at all! Having a strong understanding of all the places your organisation’s infrastructure is exposed to the world is the first step in securing them. How can you protect things that you don’t even know about?
“Employee Security Awareness Training – Even the most basic understanding and awareness of security can go a long way. Ninety-five percent of security breaches involve at least some interaction with an employee – whether it’s getting them to click a malicious link, open a dangerous file, or provide restricted information over the phone. A basic security awareness training can help your employees identify these situations and stop the attack before it even starts.
BONUS: A gift you can give your board – Give your board the gift of a well-thought out, full-fledged incident response plan so that they can sleep well over the holidays knowing that you have everything under control, even in the case of an unexpected security incident.
Oscar Tovar, application security specialist at WhiteHat Security
Cross-device security tools
The good news is that organisations are embracing BYOD (bring your own device) more than ever before. A recent Bitglass study found that 76% are making it available to employees, 25% to partners, and 22% to customers. The less positive news is that around half of organisations (51%) believe that the number of threats targeting mobile devices is increasing.
On top of that, only 30% of firms are confident that they are properly defending against malware on personal and mobile devices. So, at top of every CISO’s Christmas list this year should be a set of tools that secures data in any type of device, including personal mobile phones in BYOD environments.
Anurag Kahol, CTO at Bitglass
Multi-layered cloud security
It’s hard to pick one key gift for CISOs this Christmas, so instead why not pick a multitude wrapped up in one, shiny package? As an increasing number of organisations are moving to the cloud due to the flexibility and scalability it offers, having strong security measures is vital to ensuring that any solutions you implement are effective and reliable.
The best managed hosting providers will offer a multi-layered suite which should include services such as data encryption, a DDoS defence system, and intrusion protection and detection systems. With data breaches up 75% in the last two years according to the ICO, organisations should be prioritising their cloud security this Christmas to avoid risking an attack; because when you’re in the middle of cooking the Christmas turkey, you shouldn’t have to be worrying about your data centre going down!
Jon Lucas, co-director at Hyve Managed Hosting
Instant downtime recoverability
Surely the main thing every CISO wants on their Christmas list is the ability to recover from any kind of downtime instantly – without customers even realising anything has occurred, and with no data being lost. In 2018, it became clear that current backup solutions are no longer fit for purpose, with nearly half of all businesses experiencing an unrecoverable data event in the last three years. And, as ransomware attacks in particular will more than likely grow in 2019, CISOs need to focus on enabling an ‘always on’ business – weathering the disruption and getting back online within seconds without the data loss.
With this sort of reliable data availability, CISOs can finally enjoy a Christmas break and let concerns about ransomware and security threats take a back seat in the New Year to a more positive focus on proactive cybersecurity and preparing for whatever the next threat on the horizon may be. With Santa’s sack full of resilient gifts, eliminating these concerns will be more than merely a Christmas miracle.
Steve Blow, tech evangelist at Zerto
Employee educuation
Top of every CISO’s Christmas this year will be the key to defending against social engineering attacks: education. By training employees to question and look out for suspicious emails – for example, checking if the sender email address looks odd and scanning the email for poor grammar and spelling – organisations can reduce the likelihood of successful attacks. Giving employees the skills and knowledge they need to identify potential attacks is the best way of mitigating the insider threat risk.
Steve Wainwright, managing director EMEA at Skillsoft
A cloud-based SD-WAN
Businesses are moving towards a cloud-based, ‘as a service’ way of working, and reliable, cost-effective and secure connectivity is the number one element that they must get right. It doesn’t matter whether you are operating a restaurant, a retail outlet or a walk-in health clinic. The need to connect sensitive data driven by payment, accounting, settlement and patient record applications that are bandwidth hungry requires robust connectivity.
Dedicated private network alternatives tend to be too bandwidth-limited at acceptable price points. Traditional broadband solutions provide the best value, but pose security challenges. Added to that, smaller businesses in particular tend to have limited IT staff, and smaller budgets. A cloud-based SD-WAN should be at the top of every IT team’s Christmas wish list. It is a modern approach to connectivity, that reduces complexities and lowers costs, whilst improving security and increasing overall network flexibility.
Hubert da Costa, SVP and GM EMEA and APAC at Cybera
Advanced security for resellers
Advanced security is and will continue to be a hot topic for years to come. Resellers need to understand first and foremost that they need to protect themselves. You simply can’t go out and promote that you are decreasing risk posture for your customers whilst your own home is left unprotected. Those who are exposed will be driven out of business. Resellers must learn how to sell security based upon education, compliance and adherence to standards over time and constant vigilance.
Gregg Lalle, SVP International Sales and Strategy at ConnectWise
Budget and bandwidth to deliver a data-centric security strategy
According to the 2018 Insider Threat report, 90% of organisations are vulnerable to insider threats, and more than 50% have experienced an insider attack in the last year. The insider threat can be difficult to catch because these are people who have legitimate access to the network. Plus, BYOD and the cloud have made the traditional network perimeter obsolete, meaning that it is more difficult for IT teams to track where company data is going and who is using it.
Top of every CISO’s Christmas list this year should be budget and bandwidth to deliver a data-centric security strategy. This can go a long way in reducing the likelihood of these insider attacks by preventing employees from copying, moving or deleting data unless they have given specific permission or approval to do so.
Jan van Vliet, VP EMEA at Digital Guardian
Read more: Cybersecurity predictions for 2020: 45 industry experts have their say
