Authored by Theresa Payton, CEO, Fortalice Solutions LLC, and former White House CIO.

Today’s cybersecurity challenges require a new way of thinking if organizations are going to successfully thwart attackers. After all, if solving cybersecurity and privacy issues were as simple as following best security practices, everyone would plug the holes and be safe. Unfortunately, it’s not that easy.

Overcoming Cybersecurity Challenges

Expanding cybercriminal threats are pressuring every type of organization — from businesses to government agencies — to deploy new security capabilities at warp speed. The rapid growth of cybercrime innovation is only outpaced by the massive explosion in new technology, apps and network complexity. This is a seemingly unwinnable combination.

Why not just throw more resources at the problem? Who better to answer that question than Fortune 500 companies who were recently hacked? They would likely say that their healthy budget did not protect their most valuable resources. Organizations must view cybersecurity as both a design issue and a human psyche issue, not just as a technical or economic issue.

How do we remove complexity yet balance security measures, operational efficiency and individual motivation?

When I was the White House Chief Information Officer (CIO), my team knew security came down to people. We knew we had to address the complexity of our systems and technology. We also had to win over the hearts and minds of the staff if we wanted to protect their privacy and security. Our security protocols were meaningless if we made them too difficult for people to do their jobs.

Of course, everything at the White House was considered critical and sensitive data, but we knew we couldn’t protect every asset the same way. Just as the Secret Service has a clear focus — to physically protect the president and vice president — our team in the CIO’s office had a similar way of thinking.

Securing the White House

The CIO’s office is there to protect all assets. However, with a limited time frame and resources, we always had a laser focus on the top two most critical assets.

The first example of how we took this approach might remind you of “Downton Abbey.” Many people may not realize that the White House Usher’s Office has a long and rich history of providing elegant service and follows strict protocols steeped in tradition. Yet modern times are evident even there; for example, every chicken breast and every flower stem has to be bar-coded.

This inventory system enables the White House to know when it needs to order more and which budget pays for it. Obviously, the security team wanted to protect the inventory of food and flowers that came into the White House, but those digital assets did not have the same prioritization for protection as, say, the president’s schedule.

It sounds simple, but many companies have a “protect it all” strategy that ultimately undermines security; the steps they take are too big. Yet other companies think too small. My career has taught me that taking incremental steps in cybersecurity technology and privacy will put us further behind in countering the threat environment.

Security, as many companies approach it, is fundamentally broken. That’s why you will always have headlines saying, “The Biggest, Baddest Breach Ever!” All that changes are the names of the victims, what the attackers stole and how it happened.

Our attackers have their own playbook and near limitless resources because they don’t play by the rules. They aren’t inhibited by background checks, the alphabet soup of security certifications on a resume or a compliance checklist. Cybercriminals can play all day. They only have to get it right once and their job is done.

Preparing for the Worst

Every CEO I have worked with since founding Fortalice has told me they thought a security incident would never happen to them. Sometimes they thought it was because they were too small or too unknown to be a target. Other times they assumed the money spent to be in compliance with security audits and regulations would save them. Despite their best efforts, however, a vendor or employee often unwittingly made a mistake and let the bad guys in.

Going forward, there are three smart steps you can take to defeat cybersecurity challenges:

  1. Establish a kill switch that stops a breach in its tracks but enables your organization to function without compromising security or privacy.
  2. Commit to a new way of thinking. Security and innovation will be on equal footing, and your security team will be involved at the earliest stages possible.
  3. Segmentation is key. Organizations must design ways to segment their top two most critical digital assets to save them.

More from Risk Management

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

Why federal agencies need a mission-centered cyber response

4 min read - Cybersecurity continues to be a top focus for government agencies with new cybersecurity requirements. Threats in recent years have crossed from the digital world to the physical and even involved critical infrastructure, such as the cyberattack on SolarWinds and the Colonial Pipeline ransomware attack. According to the IBM Cost of a Data Breach 2023 Report, a breach in the public sector, which includes government agencies, is up to $2.6 million from $2.07 million in 2022. Government agencies need to move…

Back to basics: Better security in the AI era

4 min read - The rise of artificial intelligence (AI), large language models (LLM) and IoT solutions has created a new security landscape. From generative AI tools that can be taught to create malicious code to the exploitation of connected devices as a way for attackers to move laterally across networks, enterprise IT teams find themselves constantly running to catch up. According to the Google Cloud Cybersecurity Forecast 2024 report, companies should anticipate a surge in attacks powered by generative AI tools and LLMs…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today