Authored by Theresa Payton, CEO, Fortalice Solutions LLC, and former White House CIO.

Today’s cybersecurity challenges require a new way of thinking if organizations are going to successfully thwart attackers. After all, if solving cybersecurity and privacy issues were as simple as following best security practices, everyone would plug the holes and be safe. Unfortunately, it’s not that easy.

Overcoming Cybersecurity Challenges

Expanding cybercriminal threats are pressuring every type of organization — from businesses to government agencies — to deploy new security capabilities at warp speed. The rapid growth of cybercrime innovation is only outpaced by the massive explosion in new technology, apps and network complexity. This is a seemingly unwinnable combination.

Why not just throw more resources at the problem? Who better to answer that question than Fortune 500 companies who were recently hacked? They would likely say that their healthy budget did not protect their most valuable resources. Organizations must view cybersecurity as both a design issue and a human psyche issue, not just as a technical or economic issue.

How do we remove complexity yet balance security measures, operational efficiency and individual motivation?

When I was the White House Chief Information Officer (CIO), my team knew security came down to people. We knew we had to address the complexity of our systems and technology. We also had to win over the hearts and minds of the staff if we wanted to protect their privacy and security. Our security protocols were meaningless if we made them too difficult for people to do their jobs.

Of course, everything at the White House was considered critical and sensitive data, but we knew we couldn’t protect every asset the same way. Just as the Secret Service has a clear focus — to physically protect the president and vice president — our team in the CIO’s office had a similar way of thinking.

Securing the White House

The CIO’s office is there to protect all assets. However, with a limited time frame and resources, we always had a laser focus on the top two most critical assets.

The first example of how we took this approach might remind you of “Downton Abbey.” Many people may not realize that the White House Usher’s Office has a long and rich history of providing elegant service and follows strict protocols steeped in tradition. Yet modern times are evident even there; for example, every chicken breast and every flower stem has to be bar-coded.

This inventory system enables the White House to know when it needs to order more and which budget pays for it. Obviously, the security team wanted to protect the inventory of food and flowers that came into the White House, but those digital assets did not have the same prioritization for protection as, say, the president’s schedule.

It sounds simple, but many companies have a “protect it all” strategy that ultimately undermines security; the steps they take are too big. Yet other companies think too small. My career has taught me that taking incremental steps in cybersecurity technology and privacy will put us further behind in countering the threat environment.

Security, as many companies approach it, is fundamentally broken. That’s why you will always have headlines saying, “The Biggest, Baddest Breach Ever!” All that changes are the names of the victims, what the attackers stole and how it happened.

Our attackers have their own playbook and near limitless resources because they don’t play by the rules. They aren’t inhibited by background checks, the alphabet soup of security certifications on a resume or a compliance checklist. Cybercriminals can play all day. They only have to get it right once and their job is done.

Preparing for the Worst

Every CEO I have worked with since founding Fortalice has told me they thought a security incident would never happen to them. Sometimes they thought it was because they were too small or too unknown to be a target. Other times they assumed the money spent to be in compliance with security audits and regulations would save them. Despite their best efforts, however, a vendor or employee often unwittingly made a mistake and let the bad guys in.

Going forward, there are three smart steps you can take to defeat cybersecurity challenges:

  1. Establish a kill switch that stops a breach in its tracks but enables your organization to function without compromising security or privacy.
  2. Commit to a new way of thinking. Security and innovation will be on equal footing, and your security team will be involved at the earliest stages possible.
  3. Segmentation is key. Organizations must design ways to segment their top two most critical digital assets to save them.

More from Risk Management

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging.We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically.For this reason, 75% of organizations seek to…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How NIST Cybersecurity Framework 2.0 Tackles Risk Management

4 min read - The NIST Cybersecurity Framework 2.0 (CSF) is moving into its final stages before its 2024 implementation. After the public discussion period to inform decisions for the framework closed in May, it’s time to learn more about what to expect from the changes to the guidelines. The updated CSF is being aligned with the Biden Administration’s National Cybersecurity Strategy, according to Cherilyn Pascoe, senior technology policy advisor with NIST, at the 2023 RSA Conference. This sets up the new CSF to…

Why consumer drones represent a special cybersecurity risk

3 min read - Cybersecurity staff at an East Coast financial services company last summer detected unusual activity on its internal Atlassian Confluence page originating inside the company’s network. The MAC address used locally belonged to an employee known to be currently using the same MAC address remotely, according to a security specialist named Greg Linares, who had secondhand information about the attack. So, the team used a Fluke AirCheck Wi-Fi Tester device to identify the device logged in, which led the team to…