“Brace yourselves; winter is coming.” These pithy words of warning, delivered by Eddard “Ned” Stark on the HBO television show Game of Thrones, have come to apply not just to the on-screen machinations of the always battle-ready House Stark, but to any situation demanding the utmost vigilance.
While the phrase – accompanied by an image of Stark against a snowy backdrop – has been reworked in countless satirical meme images, there’s a serious real-world message for the world of cybersecurity, where the costs of a data breach to a business, if managed incorrectly, can be incredibly damaging. It can mean a long, hard winter inside the office – no matter what season it is outside.
CompTIA’s new report, 2018 Trends in Cybersecurity: Building Effective Security Teams, indicates that today’s enterprises and SMBs might not be as vigilant as they think they’re being. Let’s take a look at where the perception is falling short of the reality and see what adequate preparedness for a data breach and its aftermath really means.
Cybersecurity Perceived vs. the Cybersecurity Reality
According to the study, 46 percent of enterprises report their current level of cybersecurity as being “good enough.” And with only 39 percent stating that they have a communications plan in place in case of a data breach, there’s even further evidence that businesses feel secure enough to work without a net.
Chris Hodson, CISO EMEA at Tanium and a member of the CompTIA Cybersecurity Advisory Committee, feels businesses today may be laboring under an alarming, false sense of cybersecurity.
“If your organization really understands cyber-risk and you’ve established who your threat actors are, you’ve established the potential events that they can initiate, and you understand the vulnerabilities in your estate, and you’ve designed controls commensurate to protect yourself from those actors, then I would assert that [claiming to have adequate cybersecurity] is a qualified statement,” Hodson said. “But how many organizations do you know who have actually gone through that established process? Not many.”
A New, All-In Cybersecurity Paradigm
In order for businesses to determine who might want their data and what they’d be willing to do to get it, it’s critical that they know themselves what data they have, why it’s important, where it resides and how valuable it might be to threat actors. This is accomplished by, as Hodson describes, a coordinated effort between all departments.
“You need to classify information,” Hodson said. “You need classify your assets and you need to understand what’s important to your company and then work backwards from there. You would look at the information in question and prioritize that via things like business impact assessments.”
Having each business unit throughout an enterprise assess their data and its importance is the first step to understanding who might want to steal it, which allows business units to coordinate with IT to determine the most efficient, effective and realistic way to protect it.
It is also the first step to putting together a data breach communications plan, which is critical. Ineffective communication internally in the wake of the breach can prolong the incident. Externally it can lead to customer frustration and attrition, multiplying the impact of the breach.
Planning for a Cybersecurity Winter Every Season
A piece of good news coming out of the 2018 Trends in Cybersecurity report is that businesses do appear to be shifting their thinking on data breaches.An aggregate 63 percent report valuing a largely detection-/response-based strategy or a combined defensive/response-based strategy rather than the old-school method of pure network defense. And while only 54 percent report having a post-breach education and mitigation strategy in place, 67 percent do have some sort of formal incident response plan.
Risk assessment, risk mitigation and incident response preparedness are more than just buzzwords. They’re critical parts of managing the contemporary enterprise computing landscape.
Today, data breaches are common, cyber-threats are omnipresent and they can be disastrous to a business if not approached correctly. But planning for the winter of a data breach the right way and maintaining enterprise-wide vigilance means businesses can still enjoy the weather.
Click here to download 2018 Trends in Cybersecurity: Building Effective Cybersecurity Teams and here to get involved with CompTIA’s IT Security Community.
Matthew Stern is a freelance writer based in Chicago who covers information technology, retail and various other topics and industries.
