How to Operationalize Security with Enterprise-Wide Engagement
- By Steven Minsky
- Apr 10, 2017
Security in the modern business environment – when executed correctly – is the sum of two parts. It requires analysis of external cyber threats, which helps identify and design the best defenses, but also a high level of operational transparency within your organization. Without that transparency, your security team can’t engage the necessary parties, and it becomes impossible to make sure everyone is adhering to your cybersecurity standards.
Organizations that first turn to specialized cybersecurity tools and services are surprisingly not as prepared as they should be. No matter how well-defended a castle’s front gate is, occupants are still vulnerable if other points of entry aren’t covered with a guard shift. Similarly, each unit should only have access to the wings it needs to accomplish its duties. Companies today have such complex operations that it’s very rare for the security team – much less the CISO – to have full visibility into all potential vulnerabilities.
Additionally, “63% of confirmed data breaches involved weak, default or stolen passwords,” according to the 2016 Data Breach Investigations Report. Battening down the hatches therefore doesn’t require sophisticated security technology, but improved governance. According to Ponemon Institute research, up to 58 percent of companies use "mostly manual monitoring and testing" to monitor access policy compliance. This makes it easier for attackers to exploit privileged access rights. Indeed, manual processes make it extraordinarily difficult to enforce permissions/access rights and to detect unusual behavior.
Why Governance Holds Your Security Program Together
No matter how much you spend on new hardware, software, and services, if you don’t enforce strong policies – specifically, those related to passwords, asset management, and access rights – you won’t be able to identify and manage your vulnerabilities. There are simply too many changing processes owned by too many departments for one individual or team to handle. Security teams need to break responsibilities into manageable components, make each department accountable for a certain piece, and finally, ensure action is taken on those areas of responsibility. All this activity then needs to be aggregated and reported on.
Without proper governance oversight, silos operate in the blind, and they’re unable to coordinate activities and responsibilities. This leads to redundancy, inefficiency, and worst of all, risks that slip under the radar and lead to incidents.
Since a majority of breaches result from preventable behavior, not poor technology, operationalizing an effective process has three main components. All three require cooperation between multiple departments:
Identify areas of vulnerability: Attain full visibility across the organization by involving the right parties. The security team is ultimately responsible for making sure all employees follow secure practices and all assets are protected from cyber risks. To do so, security needs to tap into the asset oversight capabilities of the finance department.
Finance handles the acquisition and billing of all assets, including hardware, internal software, and third-party applications. By reaching out to finance and accessing this master asset list, security can take the first step to operationalizing your meticulously crafted cyber policy: identifying all vulnerabilities, or points of access, through which data breaches might be initiated.
Assign roles to appropriate process owners: Once security has a map of all the applications and devices to evaluate, the team still needs a way to notify the managers (throughout the organization) who have direct oversight of those assets. How many employees have administrative access to the payroll system, for example? Is that number limited only to the accounting team and any other essential personnel? As another example, does every employee using a software that handles sensitive data log in with a unique, secure password that meets the requirements stated in your policy? Do consultants or employees have access appropriate to their needs/roles?
If left to its own devices, which is the case in an organization with poor governance, security will be unable to individually contact each process owner to acquire this information. The more difficult it is to understand who can handle which component of the policy, the more difficult it is to create accountability, and the less likely it is that the policy will become a reality.
Perform regular monitoring to enforce the policy: As mentioned previously, it’s not the existence of a security policy that protects your organization, but the successful implementation and maintenance of that policy. Requiring individual managers to handle certain components of the policy is half the battle; this breaks the process down into manageable components and prevents the paralysis that often afflicts security teams that don’t have access to other departments’ resources.
The second half of the battle is creating a system of accountability. Are process owners executing action items on time? Which line items are outstanding, and what’s their timeframe for completion? Managers should be notified of impending due dates and what they need to do to meet those deadlines.
What Connects It All?
The process discussed in this article is enterprise-wide. It allows you to make full use of resources that already exist within your company. An enterprise risk management system allows security to automate the interaction with each department and process owner. It provides a centralized location for all departments, uncovering relationships (such as finance’s access to an asset list) that wouldn’t otherwise be visible. It must also allow security to push out assessments, notifications, and tasks to the appropriate party. Together, these capabilities create visibility into all parts of the security implementation process, and alerts go out for any exceptions.
Enterprise risk management (ERM) systems bridge silos by allowing you to tap into relationships and dependencies that already exist, mostly under the radar. Unlike spreadsheets, ERM automates the process, sending recurring notifications and mapping connections between access and assets. Automated reports sent to key stakeholders make it easy to identify missing pieces, implement your policy, and report to senior management and regulators. Robust reports provide protection from class action law suits for negligence, and will meet cyberinsurance requirements to perform the above activities.