There are so many delegated operations in any business — finance, legal, physical plant functions, etc. — that any number of them can be easily overlooked. Without checking over every minute detail, the overall business appears to function with minimal involvement.

Of course, there are a thousand invisible hands working in the background to keep everything running as smoothly as possible, and these people often don’t get the recognition they deserve, especially when it comes to your enterprise security program.

What You See Versus What You Get

At a high level, we tend to hold some of the same assumptions about cybersecurity as our personal health: If problems aren’t showing on the outside, everything must be good on the inside.

Management and employees alike are guilty of this approach — it’s just human nature. If money is spent, actions are taken and IT says all is well with security, the rest of the organization simply goes about its business, presumably in good health. But there’s almost always something lurking behind the scenes that the experts have overlooked or chosen to ignore. Therein lies the real challenge with security: The situation is often not what it appears to be.

How Confirmation Bias Works Against Your Security Program

It’s easy to go through the motions to evoke the image of a functioning cybersecurity strategy. That’s what confirmation bias trains our minds to look for. We see what we want to see — such as positive security outcomes — and then we seek the evidence necessary to prove our case.

Below are just a few aspects of security that might create an illusion of protection and resiliency if not appropriately supplemented:

  • A formal security committee that meets periodically to review network events and security projects and develop and implement new policies.
  • Well-written policies and procedures that are communicated to users and enforced where necessary.
  • Oversight of the aspects of security visibility, control and response by managed security services providers, security auditors and consultants.
  • Network, application and endpoint security controls that work to protect users from themselves and keep external attackers away.
  • Cyber insurance coverage that provides a safety net for when a security incident takes place.

While these are indeed elements of a well-run security program, all business leaders must face the reality that their organization might not be quite as resilient as they assume, no matter how much money and resources they’ve devoted to it.

Elements of a Well-Planned Security Program

If not properly formed and managed, security committees can be dysfunctional and end up impeding rather than promoting security. Consider what can be done better or differently to improve communication and oversight.

Likewise, security policies can be too heavily relied upon. Although security documentation is a necessary element that auditors, regulators and others will ask for, it can create more security problems than it solves if it’s not backed up by technical controls and a culture of privacy and security.

It’s essential to communicate your security documentation — standards, policies, procedures — regularly and proactively and enforce it thoroughly. Consider bringing on users and executive management to be part of the solution and help fill security gaps. Conducting security awareness training and soliciting program feedback are two ways to keep people engaged with your security program.

Furthermore, security controls, when not properly integrated, can be a challenge to interface with your network and security management environment. Vulnerability and penetration testing are only as good as your response to the lessons learned. Review those takeaways along with your information risk assessment to determine what gaps exist and attain a reasonable level of security.

When All Else Fails, Trust But Verify

If the proper implementation and oversight are lacking in a security program, the risks can fester, whether leadership fully understands them or not. With the constant, multifaceted activity in security, it’s easy to get distracted and leave stones unturned.

That’s why you should trust but verify: Keep operations running smoothly, but watch for common indicators that a device accessing your network is operated by a malicious actor. Artificial intelligence (AI)-enabled security monitoring can help fill security gaps in your organization.

There’s no such thing as perfect security, but if you closely examine its various functions individually and as a whole, you will almost certainly find room for improvement in areas involving people, process and technology. The important thing is to constantly seek new knowledge, do the best with what you’ve got, think for yourself and hold others accountable. Security has to be an enterprisewide team effort.

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…