Your Biggest Cybersecurity Threat is Poor Communication

Your Biggest Cybersecurity Threat is Poor Communication

The importance of communication in preventing and remediating cyberattacks

When it comes to cybersecurity, it’s all too easy to focus only on prevention.  Don’t get me wrong, securing critical systems and data is one of the top priorities for any Chief Security Officer (CSO) or Chief Information Security Officer (CISO). That means deploying everything from firewalls to intrusion detection systems to end-point security – and monitoring it continuously and effectively.

But the hard truth of conventional IT security is that enterprises play defense while hackers are playing offense. To win, the hackers only need to get an attack right once while corporate security strategies must be impregnable at all times. With technology like automated botnets that can launch thousands of attacks a second – not to mention users who click on malware-filled emails – the odds are that an attack will get through at some point.

Lost in the various technology discussions surrounding cybersecurity is the importance of effective internal communications before, during and after an attack. An organization’s ability to quickly muster counter measures when they are targeted for a cyberattack could be the difference between a data breach that costs millions and a slight blip in operations.

All Hands on Deck

Creating a culture of security helps prevent breaches and requires input from a variety of departments including IT, HR, marketing, facilities, and anyone else regularly involved in managing critical systems. In the event of a breach, CSOs and CISOs need to give every job function a clearly defined role based on their skills, location and availability. A simple call sheet is not sufficient.

Preparation is a Must

All the technology in the world won’t prevent an attack if employees are not fully trained on security awareness. Workers are an organization’s first line of defense so it is the security team’s responsibility to train and publish best practices around spear phishing (the use of fraudulent emails aimed at specific users to launch an attack) so employees know how to recognize suspicious emails, links and attachments. Those split-second decisions to quarantine or open an email can expose critical systems to attack no matter what security technology you’ve deployed. Cybercriminals are always refining their “phishing” techniques to trick users so enterprises must commit to continuous education so workers are up to date on the latest threats. While it isn’t a complete cure, keeping users from making damaging mistakes is a big win.

CISOs need buy-in from the C-suite to ensure management understands the risks to the business, the importance of developing a proactive strategy and implementing education programs not just with funding, but with their own personal example of practicing safe computing.

Response Team, Assemble!

Trust is such a vital part of how customers and business partners think about your business, which is why data breaches are particularly damaging to a company’s brand.

A coordinated, effective response can make the difference between a breach being a minor speed bump or a major hit to your brand or market value. For example, lack of adequate, proactive and prescriptive notification to all employees can drastically increase the damage from an attack by enabling criminals to compromise IT equipment rapidly as employees link their infected laptops to the company network.

Organizations may also need to establish alternate communications platforms, disconnected from the company’s infrastructure, for use during an attack if their regular telecommunications network and email systems are compromised. While quick and targeted communications with the relevant IT experts will be key, don’t forget you may also need frequent updates with management, legal, marketing, key stakeholders and partners to comply with regulations governing data privacy and security reporting.

Organizations that handled communications well after a breach typically suffer only small fluctuations in stock price and customer confidence. Those that couldn’t get the message out, or bungled the message, suffer longer-term effects.

Post-Attack Analysis

A successful post-attack communications plan provides an honest account of what went wrong, what went right and how processes can be improved to avoid a recurrence. Now is not the time to pull any punches. If a particular technology – or member of the team – didn’t perform up to expectations, new measures must be put in place to improve the outcome. 

Including an in-depth post-mortem into the enterprise cybersecurity strategy is vital as it is impossible to think about things critically during a crisis. Having a time-tested response plan in place, and a communications system to alert all the players, gives businesses a vital head start when the next cyberattack occurs.

You can’t control how hackers will try to defeat your technology and fool your users, but businesses can tilt the playing field in their favor with fast, effective, coordinated communications plans.

Featured

  • Just as Expected

    GSX produced a wonderful tradeshow earlier this week. Monday was surprisingly strong in the morning, and the afternoon wasn’t bad at all. That’s Monday’s results and asking attendees to travel on Sunday. Just a quick hint, no one wants to give up their weekend to travel and set up an exhibit booth. I’m just saying. Read Now

    • Industry Events
    • GSX
  • Allied Universal Report Highlights Expected Security Hazards

    All is not well with the world. I know that is not breaking news. Read Now

    • Industry Events
    • GSX
  • NOLA: The Crescent City

    Twenty years later we finds ourselves in New Orleans. Twenty years ago the aftermath of Hurricane Katrina forced exhibitors and attendees to look elsewhere for tradeshow floor space. Read Now

    • Industry Events
    • GSX
  • Nothing Artificial About this Intelligence

    I have been looking forward to this year’s GSX show in New Orleans, the Cresent City, or if you prefer The Big Easy. It seems like quite a while since we’ve been here. Twenty years ago, ASIS, as it was known then was literally washed out of the city by someone known as Katrina. It is a good thing to come back to NOLA. Read Now

  • From Monitors to Mission Control

    Security Operations Centers (SOC) were once defined by rows of static monitors, each displaying a single feed with operators quietly watching for issues. That model has become obsolete. Incidents evolve too quickly, data comes from multiple locations, and decisions must be made in seconds—not minutes. Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.