Authored by Theresa Payton, CEO, Fortalice Solutions LLC, and former White House CIO.
Today’s cybersecurity challenges require a new way of thinking if organizations are going to successfully thwart attackers. After all, if solving cybersecurity and privacy issues were as simple as following best security practices, everyone would plug the holes and be safe. Unfortunately, it’s not that easy.
Overcoming Cybersecurity Challenges
Expanding cybercriminal threats are pressuring every type of organization — from businesses to government agencies — to deploy new security capabilities at warp speed. The rapid growth of cybercrime innovation is only outpaced by the massive explosion in new technology, apps and network complexity. This is a seemingly unwinnable combination.
Why not just throw more resources at the problem? Who better to answer that question than Fortune 500 companies who were recently hacked? They would likely say that their healthy budget did not protect their most valuable resources. Organizations must view cybersecurity as both a design issue and a human psyche issue, not just as a technical or economic issue.
How do we remove complexity yet balance security measures, operational efficiency and individual motivation?
When I was the White House Chief Information Officer (CIO), my team knew security came down to people. We knew we had to address the complexity of our systems and technology. We also had to win over the hearts and minds of the staff if we wanted to protect their privacy and security. Our security protocols were meaningless if we made them too difficult for people to do their jobs.
Of course, everything at the White House was considered critical and sensitive data, but we knew we couldn’t protect every asset the same way. Just as the Secret Service has a clear focus — to physically protect the president and vice president — our team in the CIO’s office had a similar way of thinking.
Securing the White House
The CIO’s office is there to protect all assets. However, with a limited time frame and resources, we always had a laser focus on the top two most critical assets.
The first example of how we took this approach might remind you of “Downton Abbey.” Many people may not realize that the White House Usher’s Office has a long and rich history of providing elegant service and follows strict protocols steeped in tradition. Yet modern times are evident even there; for example, every chicken breast and every flower stem has to be bar-coded.
This inventory system enables the White House to know when it needs to order more and which budget pays for it. Obviously, the security team wanted to protect the inventory of food and flowers that came into the White House, but those digital assets did not have the same prioritization for protection as, say, the president’s schedule.
It sounds simple, but many companies have a “protect it all” strategy that ultimately undermines security; the steps they take are too big. Yet other companies think too small. My career has taught me that taking incremental steps in cybersecurity technology and privacy will put us further behind in countering the threat environment.
Security, as many companies approach it, is fundamentally broken. That’s why you will always have headlines saying, “The Biggest, Baddest Breach Ever!” All that changes are the names of the victims, what the attackers stole and how it happened.
Our attackers have their own playbook and near limitless resources because they don’t play by the rules. They aren’t inhibited by background checks, the alphabet soup of security certifications on a resume or a compliance checklist. Cybercriminals can play all day. They only have to get it right once and their job is done.
Preparing for the Worst
Every CEO I have worked with since founding Fortalice has told me they thought a security incident would never happen to them. Sometimes they thought it was because they were too small or too unknown to be a target. Other times they assumed the money spent to be in compliance with security audits and regulations would save them. Despite their best efforts, however, a vendor or employee often unwittingly made a mistake and let the bad guys in.
Going forward, there are three smart steps you can take to defeat cybersecurity challenges:
- Establish a kill switch that stops a breach in its tracks but enables your organization to function without compromising security or privacy.
- Commit to a new way of thinking. Security and innovation will be on equal footing, and your security team will be involved at the earliest stages possible.
- Segmentation is key. Organizations must design ways to segment their top two most critical digital assets to save them.
Security Intelligence Staff