There is no doubt that today’s cybersecurity arena is dynamic, fast and under constant evolution — indeed, it is seemingly impossible to keep up with. Every day, some breach or another is announced, the next world-ending vulnerability is discovered or the latest big data analytics solution is released that is going to solve everything. It is certainly exciting, but it also increases the risk of not being able to see the forest for the trees.

One thing I’ve found myself doing and talking about with customers and others in the industry is drawing parallels between cybersecurity and the more mature and well-understood area of physical security. It obviously isn’t completely analogous; for example, someone can’t physically steal from hundreds of individuals from the privacy of their own home or exploit a newly revealed physical weakness in a matter of minutes on a massive scale.

That said, there are undoubtedly some very interesting parallels between the way we approach “real-life” security and equivalent practices in the cyberworld. The following are some typical behaviors that are intrinsic in how we secure ourselves physically:

We Ensure We Protect Our Valuables First and Foremost

In the office and at home, most of us tend to leave internal doors unlocked and/or enable easy access because we trust the people who are there. However, we typically do not leave valuable jewelry on display, the car keys sitting on the windowsill or a stack of cash on the office desk overnight. We know where our valuables are, and we go to some effort to hide them, lock them down, check on them regularly and generally make sure only those who need them can access them. We know that is what criminals are most likely to be after, so we ensure they are as safe as possible.

We Watch Closely and Are More Careful Around People We Don’t Trust

When we are surrounded by people we trust and know well, we tend to be less cautious. We don’t mind leaving our phone and wallet on the table; we talk openly and don’t scrutinize every word in every conversation; we relax and spend less of our efforts on staying secure and apply them to other areas of life. However, when in the presence of strangers or people we have good reason not to trust, we are far more careful. We don’t leave items of value on display, and we are far more aware of conversation so that we don’t reveal anything that can be used against us or important information that would compromise those valuable things.

When We Have Something Valuable, We Are Worried About Recording Access

Most companies and — increasingly — private individuals that recognize a risk to their valuables will deploy systems to track access to their property, such as CCTV, keycards and phone-tracking apps. Most don’t sit and look at this data all day; instead, they record it and then store it so that should an incident occur, it’s possible to look back and see exactly what happened. For example, we can know who entered, when, how, what they took and whether they left anything behind. Most importantly, we can learn how to stop any breach from happening again in the future.

It Is Second Nature

For the vast majority of people, physical security is second nature. We lock front doors, we hide our valuables, we don’t leave doors on the “latch,” we close and lock windows and we are immediately more vigilant around people we don’t know and trust. It is bred into us at an early age.

I think these relate well to the following key approaches to cybersecurity:

Focus Protection and Detection on the Most Valuable Assets

Just like in the physical world, cybercriminals aren’t interested in the equivalent of low-value items in our gardens, halls, etc. They are after our crown jewels, such as customer data, account details and intellectual property. Crown jewel access should obviously be restricted only to those who need it, but access to these artifacts should also be specifically monitored for anything outside of “normal” behavior or what business policies dictate.

There are always activities going on in areas of our networks that we would prefer not to happen, such as click-happy users and dubious application downloads. However, we need to focus our limited resources on what really matters and not put onerous and expensive security processes in place where the risk doesn’t warrant it and where it will not have too much of an impact on day-to-day business processes and life. It should not distract from the really significant security incidents that could affect the business.

Watch for Communications Between Crown Jewels and Untrusted Assets

Use network “trust” zones and complement these with external threat intelligence and internal incident detection to understand whom we trust and whom we don’t trust. Then, we should monitor who is communicating with them. This doesn’t mean we should generate a security incident when they do; instead, we should be more cautious and vigilant. For example, we need to worry a lot more about vulnerabilities on assets if they are talking to untrustworthy actors as opposed to the ones we trust. If assets and users are regularly talking to dubious actors, then those should top our watch list. This should also highlight users who might need additional security training. Very importantly, if any of our crown jewels are communicated with by anything untrusted or unnecessary, we should be concerned and react quickly.

Record Everything

We should be worried about being compromised. Threats are pervasive. The Internet communication vector means they will always have an attack surface, so we must, at a minimum, record everything. We need to ensure our security systems are going to give us the visibility we need when a security incident occurs — and it will occur. We need to record logs, net flows and packet capture data so that when we need it, we have fast and easy access to understand what happened. The last thing we want when an incident occurs is to not be able to tell our stakeholders what happened and how we will prevent it from happening again. It is crucial that we can tell them this quickly and confidently.

Cybersecurity Education

Cybersecurity needs to become second nature to everyone, not just a few people. Everyone should know what is secure, what isn’t and what needs to be. Just like being aware of real-life burglars, everyone needs to think like a cybercriminal. Just like we are inherently cautious of strangers offering services at our front door, we need to be equally wary of emails and social connections. Instilling this culture will take time, but it can be helped through constant reminders and targeted training of those in high-value positions and those who are a bit loose with their URL clicking, Web browsing and third-party application downloads and use.

We could go on and draw more parallels between cybersecurity and other areas that deal with defense. For example, another favorite analogy of mine is our body’s immune system, as described by Ginni Rometty. I find that this approach can really give a different perspective and help us clearly see that forest in one of the most challenging, dynamic and all-consuming business and personal issues today.