December 17, 2018 By Kevin Beaver 3 min read

There are so many delegated operations in any business — finance, legal, physical plant functions, etc. — that any number of them can be easily overlooked. Without checking over every minute detail, the overall business appears to function with minimal involvement.

Of course, there are a thousand invisible hands working in the background to keep everything running as smoothly as possible, and these people often don’t get the recognition they deserve, especially when it comes to your enterprise security program.

What You See Versus What You Get

At a high level, we tend to hold some of the same assumptions about cybersecurity as our personal health: If problems aren’t showing on the outside, everything must be good on the inside.

Management and employees alike are guilty of this approach — it’s just human nature. If money is spent, actions are taken and IT says all is well with security, the rest of the organization simply goes about its business, presumably in good health. But there’s almost always something lurking behind the scenes that the experts have overlooked or chosen to ignore. Therein lies the real challenge with security: The situation is often not what it appears to be.

How Confirmation Bias Works Against Your Security Program

It’s easy to go through the motions to evoke the image of a functioning cybersecurity strategy. That’s what confirmation bias trains our minds to look for. We see what we want to see — such as positive security outcomes — and then we seek the evidence necessary to prove our case.

Below are just a few aspects of security that might create an illusion of protection and resiliency if not appropriately supplemented:

  • A formal security committee that meets periodically to review network events and security projects and develop and implement new policies.
  • Well-written policies and procedures that are communicated to users and enforced where necessary.
  • Oversight of the aspects of security visibility, control and response by managed security services providers, security auditors and consultants.
  • Network, application and endpoint security controls that work to protect users from themselves and keep external attackers away.
  • Cyber insurance coverage that provides a safety net for when a security incident takes place.

While these are indeed elements of a well-run security program, all business leaders must face the reality that their organization might not be quite as resilient as they assume, no matter how much money and resources they’ve devoted to it.

Elements of a Well-Planned Security Program

If not properly formed and managed, security committees can be dysfunctional and end up impeding rather than promoting security. Consider what can be done better or differently to improve communication and oversight.

Likewise, security policies can be too heavily relied upon. Although security documentation is a necessary element that auditors, regulators and others will ask for, it can create more security problems than it solves if it’s not backed up by technical controls and a culture of privacy and security.

It’s essential to communicate your security documentation — standards, policies, procedures — regularly and proactively and enforce it thoroughly. Consider bringing on users and executive management to be part of the solution and help fill security gaps. Conducting security awareness training and soliciting program feedback are two ways to keep people engaged with your security program.

Furthermore, security controls, when not properly integrated, can be a challenge to interface with your network and security management environment. Vulnerability and penetration testing are only as good as your response to the lessons learned. Review those takeaways along with your information risk assessment to determine what gaps exist and attain a reasonable level of security.

When All Else Fails, Trust But Verify

If the proper implementation and oversight are lacking in a security program, the risks can fester, whether leadership fully understands them or not. With the constant, multifaceted activity in security, it’s easy to get distracted and leave stones unturned.

That’s why you should trust but verify: Keep operations running smoothly, but watch for common indicators that a device accessing your network is operated by a malicious actor. Artificial intelligence (AI)-enabled security monitoring can help fill security gaps in your organization.

There’s no such thing as perfect security, but if you closely examine its various functions individually and as a whole, you will almost certainly find room for improvement in areas involving people, process and technology. The important thing is to constantly seek new knowledge, do the best with what you’ve got, think for yourself and hold others accountable. Security has to be an enterprisewide team effort.

More from CISO

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

Why security orchestration, automation and response (SOAR) is fundamental to a security platform

3 min read - Security teams today are facing increased challenges due to the remote and hybrid workforce expansion in the wake of COVID-19. Teams that were already struggling with too many tools and too much data are finding it even more difficult to collaborate and communicate as employees have moved to a virtual security operations center (SOC) model while addressing an increasing number of threats.  Disconnected teams accelerate the need for an open and connected platform approach to security . Adopting this type of…

The evolution of a CISO: How the role has changed

3 min read - In many organizations, the Chief Information Security Officer (CISO) focuses mainly — and sometimes exclusively — on cybersecurity. However, with today’s sophisticated threats and evolving threat landscape, businesses are shifting many roles’ responsibilities, and expanding the CISO’s role is at the forefront of those changes. According to Gartner, regulatory pressure and attack surface expansion will result in 45% of CISOs’ remits expanding beyond cybersecurity by 2027.With the scope of a CISO’s responsibilities changing so quickly, how will the role adapt…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today