December 17, 2018 By Kevin Beaver 3 min read

There are so many delegated operations in any business — finance, legal, physical plant functions, etc. — that any number of them can be easily overlooked. Without checking over every minute detail, the overall business appears to function with minimal involvement.

Of course, there are a thousand invisible hands working in the background to keep everything running as smoothly as possible, and these people often don’t get the recognition they deserve, especially when it comes to your enterprise security program.

What You See Versus What You Get

At a high level, we tend to hold some of the same assumptions about cybersecurity as our personal health: If problems aren’t showing on the outside, everything must be good on the inside.

Management and employees alike are guilty of this approach — it’s just human nature. If money is spent, actions are taken and IT says all is well with security, the rest of the organization simply goes about its business, presumably in good health. But there’s almost always something lurking behind the scenes that the experts have overlooked or chosen to ignore. Therein lies the real challenge with security: The situation is often not what it appears to be.

How Confirmation Bias Works Against Your Security Program

It’s easy to go through the motions to evoke the image of a functioning cybersecurity strategy. That’s what confirmation bias trains our minds to look for. We see what we want to see — such as positive security outcomes — and then we seek the evidence necessary to prove our case.

Below are just a few aspects of security that might create an illusion of protection and resiliency if not appropriately supplemented:

  • A formal security committee that meets periodically to review network events and security projects and develop and implement new policies.
  • Well-written policies and procedures that are communicated to users and enforced where necessary.
  • Oversight of the aspects of security visibility, control and response by managed security services providers, security auditors and consultants.
  • Network, application and endpoint security controls that work to protect users from themselves and keep external attackers away.
  • Cyber insurance coverage that provides a safety net for when a security incident takes place.

While these are indeed elements of a well-run security program, all business leaders must face the reality that their organization might not be quite as resilient as they assume, no matter how much money and resources they’ve devoted to it.

Elements of a Well-Planned Security Program

If not properly formed and managed, security committees can be dysfunctional and end up impeding rather than promoting security. Consider what can be done better or differently to improve communication and oversight.

Likewise, security policies can be too heavily relied upon. Although security documentation is a necessary element that auditors, regulators and others will ask for, it can create more security problems than it solves if it’s not backed up by technical controls and a culture of privacy and security.

It’s essential to communicate your security documentation — standards, policies, procedures — regularly and proactively and enforce it thoroughly. Consider bringing on users and executive management to be part of the solution and help fill security gaps. Conducting security awareness training and soliciting program feedback are two ways to keep people engaged with your security program.

Furthermore, security controls, when not properly integrated, can be a challenge to interface with your network and security management environment. Vulnerability and penetration testing are only as good as your response to the lessons learned. Review those takeaways along with your information risk assessment to determine what gaps exist and attain a reasonable level of security.

When All Else Fails, Trust But Verify

If the proper implementation and oversight are lacking in a security program, the risks can fester, whether leadership fully understands them or not. With the constant, multifaceted activity in security, it’s easy to get distracted and leave stones unturned.

That’s why you should trust but verify: Keep operations running smoothly, but watch for common indicators that a device accessing your network is operated by a malicious actor. Artificial intelligence (AI)-enabled security monitoring can help fill security gaps in your organization.

There’s no such thing as perfect security, but if you closely examine its various functions individually and as a whole, you will almost certainly find room for improvement in areas involving people, process and technology. The important thing is to constantly seek new knowledge, do the best with what you’ve got, think for yourself and hold others accountable. Security has to be an enterprisewide team effort.

More from CISO

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Boardroom cyber expertise comes under scrutiny

3 min read - Why are companies concerned about cybersecurity? Some of the main drivers are data protection, compliance, risk management and ensuring business continuity. None of these are minor issues. Then why do board members frequently keep their distance when it comes to cyber concerns?A report released last year showed that just 5% of CISOs reported directly to the CEO. This was actually down from 8% in 2022 and 11% in 2021. But even if board members don’t want to get too close…

The CISO’s guide to accelerating quantum-safe readiness

3 min read - Quantum computing presents both opportunities and challenges for the modern enterprise. While quantum computers are expected to help solve some of the world’s most complex problems, they also pose a risk to traditional cryptographic systems, particularly public-key encryption. To ensure their organization’s data remains secure now and in the future, chief information security officers (CISOs) should educate themselves about quantum computing, proactively address the coming quantum risks to cybersecurity and work to establish cryptographic agility in their enterprise.A future cryptographically…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today