May 23, 2023 By Jennifer Gregory 3 min read

The World Economic Forum recently published a list of trends that are likely to shape the future of cybersecurity by 2030. The article names “progress in cybersecurity, but access must be widened” as a top trend.

If these two goals seem contradictory, it’s because they are. Today’s business model requires that systems, people and devices have the ability to access data. But at the same time, that ability can enable a cyberattack that causes significant business disruption.

Many businesses struggle to walk the fine line between allowing access to all who need it while still protecting their systems.

Instead of simply implementing tight security measures and processes, organizations must instead evaluate both their risk and their cybersecurity in terms of how it restricts access.

Here are six ways to reduce risk while increasing access.

1. Make cybersecurity a business priority at the top

Often, the stakeholders in cybersecurity not only bring different perspectives, but they also don’t speak the same language.

By making cybersecurity a shared interest and responsibility, your organization’s leadership becomes equally responsible for it. Additionally, clearly communicating the business value — especially in terms of revenue losses and business disruption — often helps create lightbulb moments for company leaders.

2. Implement a zero trust framework

Organizations continuing to use the traditional approach of protecting their endpoints increase their risk of cyberattacks. With today’s dispersed and remote workforce, this model does not provide both the protection and access needed for how work gets done.

By moving to a zero trust approach, organizations assume that every user, device and application is not authorized until proven otherwise.

3. Maintain a complete list of all suppliers and vendors

Your business inherits the risk of all of your suppliers and vendors. If they have a breach or cybersecurity issue, the criminal can often gain access to your systems and data as well.

As part of the onboarding process for vendors and suppliers, conduct a cybersecurity audit and consider having guidelines for suppliers and vendors to reduce your own risk.

4. Create a culture of cybersecurity

Traditional cybersecurity training doesn’t provide the education your employees need to help protect against today’s sophisticated cyber criminals.

Instead, you must create a culture of cybersecurity where every employee feels responsible for your organization’s security. Additionally, they have the knowledge needed to prevent attacks, spot potential issues and quickly mitigate attacks in process.

5. Develop a risk management strategy

In creating a formal policy, organizations evaluate their current risk and determine a process for continually monitoring it. Without a defined approach, businesses often overlook potential vulnerabilities that lead to a data breach or major cyberattack.

Organizations must start by ensuring their people have the right knowledge and permissions to monitor risk. Next, they need to ensure they are using the right technology for real-time risk mitigation. Finally, a risk management strategy involves creating repeatable processes for identifying, evaluating and mitigating any potential risk.

6. Implement SIEM solutions

Consider using Security Information and Event Management Software (SIEM). By using AI, your organization will be notified about changes and patterns that indicate threat patterns.

Additionally, SIEM solutions prioritize the threats so your team can immediately address those most likely to cause a major issue. You can also integrate SIEM tools into other cybersecurity systems to help you get a full picture of your current risk at any given time from a single location.

With organizations using data as the foundation for their business, they need the ability to provide access to the information at a level previously not needed. The conflict between access and security is not a new issue. However, the importance of both significantly increased in the past few years. Organizations that proactively create a plan for both and continually re-evaluate their processes are more likely to find the correct balance.

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today